HMAC-signed, expiring URLs and tokens over Web Crypto — magic-login links, secure download links, unsubscribe links and one-time actions. Tamper-proof, timing-safe, with magicLink() / signUrl() helpers. Fills a real gap: no self-hosted, zero-dep option existed.
Install
$ npm install @lacspace/signed-url
Quick example
@lacspace/signed-urlts
await verifyUrl(request.url, { secret })
Returns { valid: true }
Tips
Keep expiries short and include a purpose/scope in the payload so a link can't be reused elsewhere.
Watch out for
The signing secret must stay server-side — never ship it to the client.
Looking for the complete API and more examples? The npm page and GitHub README carry the full reference — or grab the PDF.
