Br Crypto

better-route: Crypto helpers

Use this for small security primitives that should not be reimplemented in plugins: random tokens, base64url encoding, and constant-time comparisons.

API

use BetterRoute\Support\Crypto;
use BetterRoute\Support\CryptoEncoding;

$state = Crypto::token(32); // base64url by default
$nonce = Crypto::token(32, CryptoEncoding::Base64Url);
$hex = Crypto::tokenHex(32);

$encoded = Crypto::base64UrlEncode($raw);
$raw = Crypto::base64UrlDecode($encoded);

if (!Crypto::equals($expected, $provided)) {
    throw new \BetterRoute\Http\ApiException('Invalid token.', 401, 'invalid_token');
}

Critical rules

• Use Crypto::equals() for PKCE verifier comparisons, nonce, state, CSRF, HMAC, and token-bound string comparisons.
• Do not use !== for secrets or attacker-controlled token strings.
• Crypto::token() uses random_bytes() and defaults to base64url.
• Crypto::base64UrlDecode() is strict and throws on malformed input.
• CryptoEncoding values are Hex, Base64, and Base64Url.

Cross-references

• Use br-single-use-token when the token must be consumed once.
• Use br-hmac-signature for signed request verification.
• Use br-jwks-jwt-auth for JWT verification; do not hand-roll JWT crypto.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Lonsdale201
• Source: Lonsdale201/wp-agent-skills
• License: MIT

Install and usage instructions live in the source repository linked above.