# Br Crypto

> Use better-route 0.6.0 Crypto and CryptoEncoding helpers for secure random token generation, base64url encoding/decoding, hex tokens, and constant-time comparisons. Triggers on Crypto::token, Crypto::tokenHex, Crypto::equals, Crypto::base64UrlEncode, Crypto::base64UrlDecode, PKCE, nonce, state, CSRF token, HMAC compare, or replacing !== token comparisons. Updated 2026-05-02.

- **Type:** Skill
- **Install:** `agentstack add skill-lonsdale201-wp-agent-skills-br-crypto`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Lonsdale201](https://agentstack.voostack.com/s/lonsdale201)
- **Installs:** 0
- **Category:** [Finance & Payments](https://agentstack.voostack.com/c/finance-and-payments)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** https://github.com/Lonsdale201/wp-agent-skills/tree/main/better-route/br-crypto

## Install

```sh
agentstack add skill-lonsdale201-wp-agent-skills-br-crypto
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# better-route: Crypto helpers

Use this for small security primitives that should not be reimplemented in plugins: random tokens, base64url encoding, and constant-time comparisons.

## API

```php
use BetterRoute\Support\Crypto;
use BetterRoute\Support\CryptoEncoding;

$state = Crypto::token(32); // base64url by default
$nonce = Crypto::token(32, CryptoEncoding::Base64Url);
$hex = Crypto::tokenHex(32);

$encoded = Crypto::base64UrlEncode($raw);
$raw = Crypto::base64UrlDecode($encoded);

if (!Crypto::equals($expected, $provided)) {
    throw new \BetterRoute\Http\ApiException('Invalid token.', 401, 'invalid_token');
}
```

## Critical rules

- Use `Crypto::equals()` for PKCE verifier comparisons, nonce, state, CSRF, HMAC, and token-bound string comparisons.
- Do not use `!==` for secrets or attacker-controlled token strings.
- `Crypto::token()` uses `random_bytes()` and defaults to base64url.
- `Crypto::base64UrlDecode()` is strict and throws on malformed input.
- `CryptoEncoding` values are `Hex`, `Base64`, and `Base64Url`.

## Cross-references

- Use `br-single-use-token` when the token must be consumed once.
- Use `br-hmac-signature` for signed request verification.
- Use `br-jwks-jwt-auth` for JWT verification; do not hand-roll JWT crypto.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** [Lonsdale201/wp-agent-skills](https://github.com/Lonsdale201/wp-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-lonsdale201-wp-agent-skills-br-crypto
- Seller: https://agentstack.voostack.com/s/lonsdale201
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.