initial commit

[squeep-resource-authentication-module] / README.md

diff --git a/README.md b/README.md
new file mode 100644 (file)
index 0000000..d93a06e
--- /dev/null
+++ b/README.md
@@ -0,0 +1,18 @@
+# @squeep/resource-authentication-module
+
+Inter-server API authentication management.
+
+Specific to Squeep Framework Applications, this module has strong opinions and makes many assumptions.
+
+This is just a time-gated pre-shared-secret HMAC bearer-token scheme.
+
+## Details
+
+A token is constructed with:
+
+- a resource identifier, which is a UUID, rendered as 24 bytes of base64url encoded string
+- the current epoch, which is rendered as a base10 string
+- a salt value, which is random data rendered in 28 bytes of base64url encoded string
+- a sha256 hmac of the above data, rendered as a base64url encoded string
+
+These fields are all joined with ':' to form the token.