pub fn base64url_encode(data: &[u8]) -> String
Encode bytes as base64url (no padding, RFC 4648 Section 5).