ESC

Auth & Security Toolkit

Cryptographic utilities for backend developers — hash passwords, generate and verify JWTs, create TOTP 2FA secrets, encrypt/decrypt data with AES-256-GCM, generate secure random tokens and asymmetric key pairs, and compute HMAC signatures.

Base URL

https://auth.toolkitapi.io/v1/

Endpoints

Passwords

Method Endpoint Description
POST /v1/auth/hash-password Hash a password with bcrypt, argon2, or scrypt
POST /v1/auth/verify-password Verify a password against a hash (algorithm auto-detected)
POST /v1/auth/password-strength Analyse password strength using zxcvbn
GET /v1/auth/generate-password Generate cryptographically secure random passwords

JWT

Method Endpoint Description
POST /v1/auth/jwt-generate Generate a signed JWT (HS256/RS256/ES256 and variants)
POST /v1/auth/jwt-verify Verify a JWT signature and decode claims
POST /v1/auth/jwt-decode Decode a JWT without verifying the signature

TOTP / 2FA

Method Endpoint Description
GET /v1/auth/totp-generate Generate a TOTP secret, otpauth URI, and QR code
POST /v1/auth/totp-verify Verify a TOTP code against a shared secret

Keys & Encryption

Method Endpoint Description
GET /v1/auth/generate-key Generate an API key, UUID v4, nanoid, or secret token
POST /v1/auth/generate-keypair Generate an RSA or EC keypair as PEM
POST /v1/auth/encrypt Encrypt plaintext with AES-256-GCM
POST /v1/auth/decrypt Decrypt AES-256-GCM ciphertext

Hashing & Encoding

Method Endpoint Description
POST /v1/auth/hash Hash a string (MD5, SHA-1, SHA-256/512, SHA3, BLAKE2b)
POST /v1/auth/hmac Generate an HMAC-SHA256/384/512 signature
POST /v1/auth/hmac-verify Verify an HMAC signature (constant-time)
POST /v1/auth/base64-encode Base64 or Base64URL encode a string
POST /v1/auth/base64-decode Decode a Base64 or Base64URL string
POST /v1/auth/encode Encode/decode in multiple formats (URL, HTML entities, hex, ascii85)

Spam Detection

Method Endpoint Description
POST /v1/email/form-spam-score Score a form submission for spam likelihood (Email toolkit)

Quick Example

from toolkitapi import Auth

auth = Auth(api_key="tk_...")

# Hash a password
result = auth.hash_password("hunter2", algorithm="argon2")
print(result["hash"])   # $argon2id$v=19$...

# Verify it
check = auth.verify_password("hunter2", result["hash"])
print(check["valid"])   # True

Python SDK

Install the SDK and import the Auth class:

pip install toolkitapi

from toolkitapi import Auth

auth = Auth(api_key="tk_...")
result = auth.jwt_generate(
    {"sub": "user_123", "role": "admin"},
    secret="my-signing-key",
    expires_in=3600,
)
print(result["token"])

The Auth client is instantiated once and reused across calls. All methods return the parsed JSON response as a Python dict.

Previous
Generation & Templates
Next
Passwords