Derive purpose-bound keys from one master secret

At a glanceCopy Anchor Link

• Who: Node developers who hold one master secret and need separate keys for cookies, tokens, or signing.
• What: Derive unrelated 32-byte keys per purpose from a single master with HKDF-SHA256, so rotation is a version bump.
• Use when: When two features must not share key bytes but you only want to manage one secret.
• Avoid when: For passwords or low-entropy input — use a password hash (argon2, scrypt) instead.
• See also: Store secrets you must read back, Sign and verify webhook deliveries

InstallCopy Anchor Link

pnpm add @zedtech/zedkit-server

Latest: 1.1.0 (via changesets).

ExampleCopy Anchor Link

import { hkdfKey } from "@zedtech/zedkit-server";
const cookieKey = hkdfKey(process.env.MASTER_KEY!, "app/session-cookie/v1");
const perTenantKey = hkdfKey(process.env.MASTER_KEY!, "app/export/v1", { salt: tenantId });

Wraps: (none)