---
id: w4/m3/t001
title: "Remove static mode: ory-only auth gate, no BEX_API_TOKEN/BEX_AUTH_MODE"
worker: worker4
status: done
estimate: 30m
depends_on: []
---

## Objective

Delete the static bearer compare and the mode switch: oryAuth is the only gate; Server loses Token/AuthMode; BEX_HYDRA_ADMIN_URL becomes required (fail-fast); tests rewired to a fake introspection backend (testToken active).

## Files

- operator/internal/api/auth.go
- server.go
- cmd/api/main.go
- api_test.go
- auth_test.go
- logs_test.go
- mcp_test.go
