Module token_secret 

Constants

TOKEN_BODY_LEN 🔒

The random part of a minted key: 32 bytes as unpadded base64url.

TOKEN_PREFIX

Marks a Pacenotes access key, for users and for secret scanners.

Functions

base64url 🔒

hash_token

Lowercase hex sha256: the only form of a credential the server keeps.

mint_token

pcn_ + 32 random bytes as unpadded base64url; the caller shows it once and stores only hash_token of it.

well_formed

Whether mint_token could have produced this, checked before any database lookup so a garbage header costs no query, which remote libSQL bills.