Pass any text string as input, such as a JSON string or plain text. The plugin encodes the exact input value as Base64URL, signs that encoded payload with HMAC-SHA256 using the plugin secret, and returns a token with this encoding structure under the hood (notice the dot in the middle):

text = base64url(your_text)

signed_text = base64url(hmac_sha256(base64url(your_text), your_secret_key))

token = text + "." + signed_text

Which will look something like this (notice the dot in the middle):

"eyJ0IjoiZGlzdCIsImkiOiIxNzcyMzA4NTc0MjY3eDE4MzUxNDQ1MTU3NjYxOTAwMCIsImUiOjE3Nzc3Nzc3Nzd9.4x6cP4hE2fD0v8l5sM7YjQY9nK2kB1rR6pW3aZ8uLmQ"


What is the secret key needed for?

The secret key is needed to generate the HMAC-SHA256 signature and/or verify it (the plugin also includes an action to verify such tokens.).

Keep the secret key value safe and never expose it in client-side workflows or page elements.