@keyring-dev/core

Framework-free API key verification. No Express, no Fastify, no HTTP types, no I/O, no promises. Every Keyring framework adapter wraps this package, and every other language SDK is held to the same conformance fixtures it is.

MIT licensed.

import { mintKey, MemoryPolicyStore, verify } from '@keyring-dev/core';

const minted = mintKey({ env: 'live' });
// Persist minted.lookupHash and minted.displayPrefix.
// Show minted.plaintext.expose() once, then forget it.

const result = verify(presentedKey, {
  store, // your local policy cache
  env: 'live', // the environment this call site serves
  requiredScopes: ['read:orders'],
});

if (!result.ok) {
  // result.code / result.status / result.message are safe to return.
  // result.reason is for your log only: every 401 looks identical to the
  // caller, deliberately.
  return respond(result.status, {
    error: result.code,
    message: result.message,
  });
}

result.key.tenantId; // who is calling
result.key.env; // 'live' | 'test' -- branch your data access on this

What it will not do

• Make a network call. PolicyStore.get is synchronous so that a remote lookup on the verification path is not expressible.
• Tell an unauthenticated caller why a key failed. Not-found, revoked and expired are one response; the distinction goes to your request log.
• Hold a pepper. The peppered hash is a control-plane value and lives in a package that is never published.
• Give you a key back. The plaintext exists once and is not recoverable.

Key format

kr_live_ / kr_test_, 24 random bytes as base64url, and a CRC-32 checksum over the prefix and body. The environment is inside the hashed material, so a test key can never resolve to env: 'live'.