@x12i/basic-auth

Small Node.js package for creating and validating encrypted app authorization keys.

This package generates self-contained encrypted authorization keys (AES-256-GCM). Keys can be validated without a database, as long as the same master secret is available.

Installation

npm install @x12i/basic-auth

Create a secret

npx x12i-basic-auth generate-secret

Then set:

export X12I_BASIC_AUTH_SECRET="x12ibas_v1_..."

Library usage

import { createAuthorizationKey, isAuthorizedForApp } from '@x12i/basic-auth';

const key = createAuthorizationKey({ appId: 'demo-app-1' });
const authorized = isAuthorizedForApp({ key, appId: 'demo-app-1' });

console.log(authorized);

CLI usage

x12i-basic-auth create --app-id demo-app-1
x12i-basic-auth validate --app-id demo-app-1 --key "x12iba_v1_..."
x12i-basic-auth resolve --key "x12iba_v1_..."

Security model

This package uses AES-256-GCM to create encrypted, tamper-resistant authorization keys.

The generated key is self-contained. It can be validated without a database, as long as the same master secret is available.

Keep X12I_BASIC_AUTH_SECRET private. Anyone with this secret can create and validate keys.

Revocation

This package does not store keys and does not provide built-in revocation.

To revoke individual keys, include the resolved keyId in an external denylist.

API

• createAuthorizationKey({ appId, secret?, keyId?, expiresAt?, expiresIn?, metadata? })
• isAuthorizedForApp({ key, appId, secret? })
• resolveAuthorizationKey({ key, secret? })
• generateSecret()

License

MIT