Hi, shikha.
SCIM endpoints are protected with [UMA](https://gluu.org/docs/ce/3.0.2/admin-guide/uma/). Test mode just saves you some efforts of implementing it to a full extent to acquire RPT, and allows to test **just** SCIM. For production you'll have to implement UMA as well (at least, you should, it's not secure otherwise). You may check our [oxd server](https://oxd.gluu.org/) product to which you can offload most of UMA intricacies.