Skip to content

DigestKey

DigestKey = object

Defined in: src/codecs/digest/key.ts:33

Opaque imported handle for one operator Digest key.

Holds a single HMAC-SHA-256 key derived via HKDF under the domain-separation label @smonn/ids/digest/hmac. The underlying webcrypto.CryptoKey is held internally and never exposed to callers. Obtain handles via importDigestKey and pass them to createDigestId as the key option.

Unlike the other keyed codecs, the Digest codec holds exactly one key — there is no keyring. Re-keying is a deliberate, breaking operator action (every ID changes), never an in-band rotation.

Distinct from the Opaque key, Wrapping key, and Signing key — the same raw bytes imported as a DigestKey are cryptographically independent of any other codec’s key.

readonly [digestKeyBrand]: "DigestKey"

Defined in: src/codecs/digest/key.ts:34