@lacspace/apikey
Issue & verify API keys the right way — prefixed high-entropy keys, store only the SHA-256 hash, constant-time verify, last-4 display. Isomorphic over Web Crypto.
npm i @lacspace/apikeyUsage
import { generateApiKey, verifyApiKey } from "@lacspace/apikey";
// on create — show `key` to the user ONCE, store the rest
const { key, hash, prefix, last4 } = await generateApiKey({ prefix: "lac_live" });
// key: "lac_live_9f8a…" (return to user, never store)
// hash: "3b2c…" (store this), prefix, last4 for display
// on each request
const presented = req.headers["x-api-key"];
if (await verifyApiKey(presented, storedHash)) { /* authorized */ }Exports 9
ApiKeyErrorauthenticateApiKeyexpressApiKeyextractApiKeygenerateApiKeyhashApiKeyisValidKeyFormatparseApiKeyverifyApiKeyKeywords
More in Security Kit
Safe, boring cryptography over Web Crypto — authenticated AES-256-GCM, PBKDF2 key derivation, SHA-256, HMAC, secure random and constant-time compare. Isomorphic (Node, edge, browser, RN).
@lacspace/headersSecure HTTP headers & a typed Content-Security-Policy builder — HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy. Framework-agnostic + Next.js. Zero-dependency, isomorphic.
@lacspace/jwtJSON Web Tokens (HS256/384/512) with strict expiry/issuer/audience checks + secure random & CSRF tokens. Isomorphic over Web Crypto — Node, edge, browser.
@lacspace/lockAccount lockout & brute-force protection (server lock) — N-strikes, exponential backoff, self-resetting window, pluggable store. Zero-dependency, isomorphic.
@lacspace/mfaOrchestrate multi-factor auth — combine password + TOTP + passkeys into 2FA/3FA step-up flows with NIST assurance levels (AAL). Zero-dependency (bar @lacspace/otp), isomorphic.
@lacspace/otpTOTP & HOTP two-factor auth, Google Authenticator compatible — generate secrets, compute/verify codes and build otpauth:// QR URIs. Built on Web Crypto: runs on Node, edge and browser. Zero-dependency, isomorphic.