Secure Token Generator

Overview

You choose the entropy width, alphabet, and optional prefix; we draw 16-64 cryptographically random bytes from SecureRandom, encode them as base64url (default), hex, base32, or alphanumeric, and report entropyBits so token strength is explicit. We never store or log the token. Do not use this when any random string will do (use platform.entropy_token) or when you need a UUID or password hash.

An LLM cannot produce randomness, and a token it invents is predictable however random it looks. Hand-rolled encoders also tend to reach for 'random byte % alphabet length', which skews the distribution and silently weakens every token issued.

When to use it

Scope

Non-goals

• Does not store, register, or track the token — the platform never sees it again
• Does not hash or sign the token
• Does not generate human-memorable passwords or passphrases
• Does not generate UUIDs (use platform.uuid_v4 or platform.uuid_namespace_id)
• Does not derive a key from a password (not a KDF)
• Does not issue platform API keys — those come from the key-management surface

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.generate_secure_token","input":{"bytes":32,"encoding":"hex","prefix":"sk_live"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.generate_secure_token", {"bytes":32});

Errors

Other limits

Limitations

• Does not store, register, or track the token — the platform never sees it again
• Does not hash or sign the token
• Does not generate human-memorable passwords or passphrases
• Does not generate UUIDs (use platform.uuid_v4 or platform.uuid_namespace_id)
• Does not derive a key from a password (not a KDF)
• Does not issue platform API keys — those come from the key-management surface
• Any random string with no format requirement (use platform.entropy_token)
• Generating a UUID (use platform.uuid_v4)
• Producing a human-memorable password
• Deriving a key from a password (use a KDF, not a random draw)

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "security.generate_secure_token",
  "input": {
    "bytes": 32
  }
}

Examples

{
  "bytes": 32
}

{
  "prefixed": false,
  "encoding": "base64url",
  "entropyBits": 256,
  "tokenLength": 43,
  "bytes": 32,
  "token": "3Yx1kQpZ9mHrTdVbN2sLwEgAjCfUoIeXvBnMk4tQzR0"
}

{
  "bytes": 16,
  "encoding": "hex",
  "prefix": "sk_live"
}

{
  "prefixed": true,
  "encoding": "hex",
  "entropyBits": 128,
  "tokenLength": 40,
  "bytes": 16,
  "token": "sk_live_9f2c41ab7d0e5836b1c4a97e2d5f0813"
}

Recommended use cases

• Mint an API key for a tenant's own downstream service in a required alphabet
• Generate a case-insensitive base32 code safe to read aloud or type
• Create a hex token for a system that rejects '-' and '_'
• Produce a prefixed credential such as 'sk_live_...' so its environment is visible in logs

Avoid for

• Any random string with no format requirement (use platform.entropy_token)
• Generating a UUID (use platform.uuid_v4)
• Producing a human-memorable password
• Deriving a key from a password (use a KDF, not a random draw)

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags