@lacspace/signed-url
HMAC-signed, expiring URLs & tokens over Web Crypto — secure download links, magic-login links, unsubscribe links and one-time-action tokens. Tamper-proof, timing-safe, zero-config. Isomorphic (Node, edge, browser).
npm i @lacspace/signed-urlUsage
import { sign, verify } from "@lacspace/signed-url";
// e.g. a password-reset link
const token = await sign({ userId: 42, action: "reset" }, {
secret: process.env.LINK_SECRET!,
expiresIn: 3600, // seconds
});
const r = await verify<{ userId: number; action: string }>(token, { secret: process.env.LINK_SECRET! });
if (r.valid) {
grantReset(r.data.userId);
} else {
// r.reason → "malformed" | "bad-signature" | "expired"
}Exports 7
isValidmagicLinkreadMagicLinksignsignUrlverifyverifyUrlKeywords
More in Backend Kit
Make any operation exactly-once with an idempotency key — replay stored results on retries, safe under concurrency, with optional request fingerprinting. Framework-agnostic, pluggable store, zero-dependency, isomorphic.
@lacspace/pdfGenerate real PDFs — invoices, receipts & documents — with zero dependencies and no headless browser. Accurate text layout, auto page-breaks, batteries-included invoice() & receipt() generators. Isomorphic (Node, edge, browser).
@lacspace/webhooksThe webhook toolkit for both directions — sign & deliver outgoing webhooks with retries, and verify incoming ones (timing-safe, replay-protected) with Stripe / GitHub / Shopify presets. Plus event ids & idempotency. One internal dependency (@lacspace/crypto), isomorphic.