auth/api_token.ts

API token generation and hashing utilities.

Tokens use the format secret_fuz_token_<base64url> and are stored as blake3 hashes. These are pure cryptographic operations with no framework dependency — the bearer auth middleware that validates tokens lives in auth/bearer_auth.ts.

view source

Declarations
#

5 declarations

API_TOKEN_ID_REGEX
#

auth/api_token.ts view source

RegExp import {API_TOKEN_ID_REGEX} from '@fuzdev/fuz_app/auth/api_token.js';

Regex for the public API token id (e.g. tok_abC0_d-3xyzA). Twelve base64url characters after the tok_ prefix. Matches the format produced by generate_api_token.

API_TOKEN_PREFIX
#

auth/api_token.ts view source

"secret_fuz_token_" import {API_TOKEN_PREFIX} from '@fuzdev/fuz_app/auth/api_token.js';

Prefix for all fuz API tokens (enables secret scanning).

ApiTokenId
#

auth/api_token.ts view source

ZodString import type {ApiTokenId} from '@fuzdev/fuz_app/auth/api_token.js';

Zod schema for the public API token id.

generate_api_token
#

auth/api_token.ts view source

(): { token: string; id: string; token_hash: string; } import {generate_api_token} from '@fuzdev/fuz_app/auth/api_token.js';

Generate a new API token with its hash and public id.

The raw token is returned exactly once — callers must present it to the user immediately.

returns

{ token: string; id: string; token_hash: string; }

the raw token, a public id, and the blake3 hash for storage

hash_api_token
#

auth/api_token.ts view source

(token: string): string import {hash_api_token} from '@fuzdev/fuz_app/auth/api_token.js';

Hash an API token for storage using blake3.

`token`

the raw API token

type string

returns

string

hex-encoded blake3 hash

Depends on
#

crypto.ts