Function getJwtSecret

apps/sim/lib/auth/internal.ts:10–18

()

const logger = createLogger('CronAuth')

const getJwtSecret = () => {
  // Prefer a dedicated JWT signing key so the internal-JWT trust domain is
  // separable from the raw INTERNAL_API_SECRET shared-bearer secret: leaking one
  // shouldn't grant the other (raw secret => call internal endpoints; JWT key =>
  // mint tokens for arbitrary userIds). Falls back to INTERNAL_API_SECRET when
  // unset so existing deployments keep working until the key is rotated in.
  const secret = new TextEncoder().encode(env.INTERNAL_JWT_SECRET || env.INTERNAL_API_SECRET)
  return secret
}

/**
 * Generate an internal JWT token for server-side API calls