Function: signingKey()
signingKey(
configuredCutoff?):Promise<SigningKey>
The signing key for this gate, resolved once per process.
Resolved ONCE, so configuredCutoff is honoured only on the first call - the
plugin’s setup() passes its resolved value there, before any request can
reach the lazy path.
TUNNEL_AUTH_JWT_SECRET when set, else the cache-backed secret. A cache that is
unavailable degrades to an ephemeral per-process key (the previous behaviour)
rather than refusing to sign: the key only validates an ALREADY-issued session,
so losing it costs sessions, never admission - a caller still needs a code
delivered to an allow-listed address.
Parameters
Section titled “Parameters”configuredCutoff?
Section titled “configuredCutoff?”string | number | Date
Returns
Section titled “Returns”Promise<SigningKey>