Many SCIM implementations have built-in static sample tokens or default tokens that can be found in documentation and allow them to be used long-term without being changed; if administrators do not proactively replace them, such tokens effectively become public credentials.