ParseAPITokens (server/apitoken.go)

Parses and validates API bearer tokens for service authentication.

// Source: https://github.com/jhaals/yopass | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
package server

import (
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"fmt"
	"net/http"
	"strings"
)

// APIToken is a named static bearer token that lets machine clients
// (internal services, automation) create secrets when --require-auth is
// enabled, without going through the interactive OIDC browser flow.
// Requests authenticate with "Authorization: Bearer <secret>" and are
// attributed in audit logs as "service:<name>". Only a SHA-256 digest of
// the secret is retained after parsing.
type APIToken struct {
	Name   string
	digest [32]byte // SHA-256 of the configured secret
}

// mi

... (truncated -- full source via MCP)