@lacspace/signed-url
HMAC-signed, expiring URLs & tokens over Web Crypto — secure download links, magic-login links, unsubscribe and one-time-action tokens — now with key rotation, method/IP/path binding, single-use nonces, signed claims and clock tolerance. Tamper-proof, timing-safe. Isomorphic (Node, edge, browser).
npm i @lacspace/signed-urlUsage
import { sign, verify } from "@lacspace/signed-url";
// e.g. a password-reset link
const token = await sign({ userId: 42, action: "reset" }, {
secret: process.env.LINK_SECRET!,
expiresIn: 3600, // seconds
});
const r = await verify<{ userId: number; action: string }>(token, { secret: process.env.LINK_SECRET! });
if (r.valid) {
grantReset(r.data.userId);
} else {
// r.reason → "malformed" | "bad-signature" | "expired"
}Exports 7
isValidmagicLinkreadMagicLinksignsignUrlverifyverifyUrlKeywords
More in Backend Kit
Make any operation exactly-once with an idempotency key — fingerprint the request (reject key-reuse with a different body), replay the stored response on retries, lock in-flight duplicates, and sweep expired records. Framework-agnostic, pluggable store, zero-dependency, isomorphic.
@lacspace/pdfGenerate real PDFs — invoices, receipts & documents — with zero dependencies and no headless browser. Accurate text layout, auto page-breaks and batteries-included invoice() & receipt() generators, now with tables, JPEG/raw images, page sizes & landscape, Times/Courier fonts, page numbers, bookmarks and Info metadata. Isomorphic (Node, edge, browser).
@lacspace/webhooksThe webhook toolkit for both directions — sign & deliver outgoing webhooks with retries/backoff, verify incoming ones (timing-safe, replay-protected) with Stripe / GitHub / Shopify presets, plus typed event envelopes, exactly-once idempotency and pure endpoint routing. One internal dependency (@lacspace/crypto), isomorphic.