diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+0.4.4.0
+=======
+
+* Add `signinByHashUnsafe` for internal usage. 
+
 0.4.3.0
 =======
 
diff --git a/servant-auth-token.cabal b/servant-auth-token.cabal
--- a/servant-auth-token.cabal
+++ b/servant-auth-token.cabal
@@ -1,5 +1,5 @@
 name:                servant-auth-token
-version:             0.4.3.0
+version:             0.4.4.0
 synopsis:            Servant based API and server for token based authorisation
 description:         Please see README.md
 homepage:            https://github.com/ncrashed/servant-auth-token#readme
diff --git a/src/Servant/Server/Auth/Token.hs b/src/Servant/Server/Auth/Token.hs
--- a/src/Servant/Server/Auth/Token.hs
+++ b/src/Servant/Server/Auth/Token.hs
@@ -65,6 +65,7 @@
   , hashPassword
   , setUserPasswordHash
   , ensureAdminHash
+  , signinByHashUnsafe
   ) where
 
 import Control.Monad
@@ -606,3 +607,27 @@
   whenNothing madmin $ do
     i <- createAdmin strength login "" email
     setUserPasswordHash passHash $ fromKey i
+
+-- | If you use password hash in configs, you cannot use them in signin
+-- method. This helper allows to get token by password hash and the function
+-- is not available for remote call (no endpoint).
+--
+-- Throws 401 if cannot find user or authorisation is failed.
+--
+-- WARNING: Do not expose the function to end user, never!
+signinByHashUnsafe :: AuthHandler m => Login -- ^ User login
+  -> Text -- ^ Hash of admin password
+  -> Maybe Seconds -- ^ Expire
+  -> m SimpleToken
+signinByHashUnsafe login pass mexpire = do
+  WithField uid UserImpl{..} <- guardLogin login pass
+  getAuthToken uid mexpire
+  where
+  guardLogin login pass = do -- check login and password, return passed user
+    muser <- getUserImplByLogin login
+    let err = throw401 "Cannot find user with given combination of login and pass"
+    case muser of
+      Nothing -> err
+      Just user@(WithField _ UserImpl{..}) -> if pass == userImplPassword
+        then return user
+        else err
diff --git a/stack.yaml b/stack.yaml
--- a/stack.yaml
+++ b/stack.yaml
@@ -47,7 +47,7 @@
 #     git: https://github.com/NCrashed/servant-auth-token-api.git
 #     commit: d011f7bfecd18d07ff67ce9f67f8741e110a2719
 #   extra-dep: true
-- '../servant-auth-token-api'
+# - '../servant-auth-token-api'
 
 # Dependency packages to be pulled from upstream that are not in the resolver
 # (e.g., acme-missiles-0.3)