Module signing 

Shared HMAC-SHA256 signing helpers used by the cookie jar (and available to any value that needs tamper-evident transport). Signatures are base64url, no-pad, and verified in constant time.

Functions

sign

Sign msg with secret, returning the base64url signature.

verify

Verify a base64url signature over msg under secret (constant time).