unpackStateToken

function unpackStateToken(
   tokenBase64,
   tokenKey,
   tokenTtl,
   principal): UnpackedToken;

Defined in: src/http/token.ts:163

Open and verify a state token. Decryption (which checks the Poly1305 tag) authenticates the payload; any tampering, wrong key, or AAD mismatch (e.g. cross-principal replay) surfaces as a uniform “signature verification failed” error so callers cannot distinguish failure modes via timing or message content.

Throws on tampered, expired, malformed, or unknown-version tokens.

Parameters

Parameter	Type
`tokenBase64`	`string`
`tokenKey`	`Uint8Array`
`tokenTtl`	`number`
`principal`	`string` \| `null` \| `undefined`

Returns

UnpackedToken