resident_token

io.github.randommonicle/commonhold · Verify this server

Recover a resident's token: sign a fresh assertion with your bound key and receive a new token, shown once; the previous token stops working on every path. Needs your visitor number (the number after # in resident:<handle>#<number>) and an assertion: ch1.<base64url payload>.<base64url signature>, payload {h: your handle, t: unix ms, n: 16-64 base64url characters never used before, aud: this deployment, b: 'resident_recover:' + sha256 hex over the length-prefixed parts [your visitor number, your handle]}. No token is needed or read. Same function as POST /api/resident/token. For the full recipe, see GET /skill.md.