---
id: w4/m2/t004
title: E2E acceptance: Hydra token → REST + GraphQL succeed; bad token → 401
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m2/t002, w4/m2/t003]
---

## Objective

Prove the integrated flow on the local mock cluster: obtain a `client_credentials` token from the in-cluster Hydra (via `scripts/auth-verify.sh` from w4/m1), call bex-api REST (`/v1/services`) and GraphQL with it in `ory` mode, and show invalid/expired credentials are rejected while legacy static mode still works.

## Context

- Builds on w4/m1 t006's script; bex-api runs with `BEX_AUTH_MODE=ory` for the test, then `static` for the regression check.
- Mock cluster kubeconfig: `infra/local/bex.kubeconfig` (never print).

## Steps

1. Extend `scripts/auth-verify.sh` (or add `scripts/auth-e2e.sh`): token → REST list + GraphQL query → assert 200; garbage token → assert 401.
2. Flip to static mode and assert `BEX_API_TOKEN` still authenticates.
3. Record the invocation in the milestone README so it's rerunnable.

## Files

- `scripts/auth-verify.sh` (or `scripts/auth-e2e.sh`, new)

## Acceptance criteria

- [ ] Script exits 0: Hydra token authenticates REST + GraphQL; bad token → 401; static fallback still works.

## Out of scope

- Load/perf testing of introspection; browser session E2E.
