Add broadcastKey helper to derive the broadcast auth key from the app secret - #6
Open
irinanazarova wants to merge 1 commit into
Open
Add broadcastKey helper to derive the broadcast auth key from the app secret#6irinanazarova wants to merge 1 commit into
irinanazarova wants to merge 1 commit into
Conversation
…secret AnyCable secures the HTTP broadcast endpoint with a key derived from the application secret (HMAC-SHA256 of 'broadcast-cable', hex-encoded) unless an explicit broadcast key is configured. Until now users had to compute that HMAC themselves to pair this SDK with a single-secret AnyCable setup. The derivation matches the server (verified against anycable-go 1.6.14: a key produced by this formula is accepted by the secured /_broadcast endpoint). Vector test included; README documents the pairing: broadcaster(url, broadcastKey(process.env.ANYCABLE_SECRET))
irinanazarova
force-pushed
the
feat-broadcast-key
branch
from
August 5, 2026 20:11
8dd87a5 to
52eead9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
When AnyCable runs with a single application secret (
ANYCABLE_SECRET), the server secures the HTTP broadcast endpoint with a key derived from that secret:HMAC-SHA256(secret, "broadcast-cable"), hex-encoded. This SDK'sbroadcaster(url, key)requires that key, and until now users had to compute the HMAC themselves (or discover the need the hard way: broadcasts fail with an auth error in the single-secret setup that the AnyCable docs recommend).What
broadcastKey(secret)export in the broadcast module, using the same synccreateHmacstyle as the existing stream signer.b12500da...for secrets3cret, cross-checkable withecho -n 'broadcast-cable' | openssl dgst -sha256 -hmac 's3cret').broadcaster(broadcastURL, broadcastKey(process.env.ANYCABLE_SECRET)).Verification
The derivation was verified against a live anycable-go 1.6.14: with only
ANYCABLE_SECRETset, the server logs "auto-generated authorization secret from the application secret ... (authorization required)", rejects unauthenticated POSTs, and acceptsAuthorization: Bearer <key from this formula>(exercised end-to-end while building the canonical serverless example for the docs).Tests 23/23 pass,
tsc --noEmitclean, eslint adds no new warnings.