newToken function

String newToken()

Mints a fresh bearer token: 32 bytes from the platform's secure random, base64url-encoded and unpadded.

Long enough that guessing is not a strategy, and URL-safe so it survives being pasted into a config file, a header or a --token flag intact.

Implementation

String newToken() {
  final random = Random.secure();
  final bytes = Uint8List.fromList([
    for (var i = 0; i < 32; i++) random.nextInt(256),
  ]);
  return base64Url.encode(bytes).replaceAll('=', '');
}