solid-adventure / trivial-api

Other
1 stars 1 forks source link

HMAC instead of RSA for client keys #223

Closed vgkids closed 9 months ago

vgkids commented 9 months ago

Before Client keys used same JWT_PRIVATE_TOKEN var, which requires a multiline env var and can introduce unnecessary complexity in CI workflows.

After Client keys use a dedicated CLIENT_SECRET var, which can be a single line string.

Note: This will invalidate any existing client keys. There is no production usage yet, but developers will need to generate a new pair of client keys using the new method.

Updates docs are here: https://trivial-js.org/guides/client-api-keys.html