secret

package

v0.2.0 Latest Latest Go to latest Published: Oct 8, 2026 License: MIT Imports: 9 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/ucgeorge/switchboard

Links

Open Source Insights

Documentation ¶

Overview ¶

Package secret generates and hashes credentials. Plaintext secrets are shown once at creation; only SHA-256 digests (for high-entropy tokens) or argon2id hashes (for passwords) are stored.

Index ¶

Constants
Variables
func Display(plain string) string
func Equal(a, b string) bool
func Hash(s string) string
func HashPassword(password string) string
func NewAPIKey() (plain, hash, display string)
func NewAgentToken() (plain, hash, display string)
func NewToken(prefix string, length int) (plain, hash, display string)
func PKCEVerify(verifier, challenge, method string) bool
func Random(n int) string
func RandomURLSafe(n int) string
func VerifyPassword(encoded, password string) bool

Constants ¶

View Source

const (
	APIKeyPrefix     = "sk-sb-"
	AgentTokenPrefix = "sba_"
	OAuthTokenPrefix = "sbo_"
	RefreshPrefix    = "sbr_"
)

Variables ¶

View Source

var ErrInvalid = errors.New("invalid credential")

ErrInvalid is returned by verifiers when a credential does not match.

Functions ¶

func Display ¶

func Display(plain string) string

Display renders a secret for UIs: prefix, a few leading chars, the tail.

func Equal ¶

func Equal(a, b string) bool

Equal compares two strings in constant time.

func Hash ¶

func Hash(s string) string

Hash returns the hex SHA-256 digest of s. Suitable for high-entropy tokens.

func HashPassword ¶

func HashPassword(password string) string

HashPassword returns a PHC-formatted argon2id hash.

func NewAPIKey ¶

func NewAPIKey() (plain, hash, display string)

NewAPIKey mints an OpenAI-style API key.

func NewAgentToken ¶

func NewAgentToken() (plain, hash, display string)

NewAgentToken mints a static MCP bearer token.

func NewToken ¶

func NewToken(prefix string, length int) (plain, hash, display string)

NewToken returns a fresh token with the given prefix plus its hash and a display prefix.

func PKCEVerify ¶

func PKCEVerify(verifier, challenge, method string) bool

PKCEVerify checks an OAuth PKCE verifier against an S256 challenge.

func Random ¶

func Random(n int) string

Random returns n random base62 characters.

func RandomURLSafe ¶

func RandomURLSafe(n int) string

RandomURLSafe returns a base64url string with n random bytes of entropy.

func VerifyPassword ¶

func VerifyPassword(encoded, password string) bool

VerifyPassword checks password against a hash produced by HashPassword.

Types ¶

This section is empty.

Source Files ¶

View all Source files

secret.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL