I don't follow what the security property is of involving sha256 against the b58 encoded value? If it serves as a checksum against tpyoss, wouldn't one wish to

I don't follow what the security property is of involving sha256 against the b58 encoded value? If it serves as a checksum against tpyoss, wouldn't one wish to include the shortToken also? Otherwise, it's just as much attacker controlled content as the b58 version is, as best I can tell As an implementation observation, I am also on a life-long campaign to rid the world of `split(...)[-1]` type manipulations, because they lack the context of a more rigorous "parsing" style. In this specific case, it allows attackers to smuggle almost arbitrary characters between the shortToken and longToken: checkAPIKey("alpha_BRTRKFsL_and this one time at band camp\r\nContent-Length: 0\r\n_51FwqftsmMDHHbJAMEXXHCgG", "d70d981d87b449c107327c2a2afbf00d4b58070d6ba571aac35d7ea3e7c79f37") Also for your consideration, the code currently has duplication: export const extractLongTokenHash = (token: string) => hashLongToken(extractLongToken(token)) // ...snip... longTokenHash: hashLongToken(extractLongToken(token)), // ...snip... ) => hashLongToken(extractLongToken(token)) === expectedLongTokenHash and my experience is that it's so easy to remember to update one and forget to update the others