Node Utilities

Server-side utilities are exported from @taskon/embed/node.

`signMessage`


signMessage(
  clientId: string,
  type: "Email" | "evm",
  account: string,
  privateKey: string
): { signature: string; timestamp: number }

The signing message format is:


${type}|${account}|${clientId}|${timestamp}

It uses RSA-SHA256 in Node.js.

Example: API Endpoint


import { signMessage } from "@taskon/embed/node";
 
export async function POST(req: Request) {
  const body = (await req.json()) as {
    type: "Email" | "WalletAddress";
    account: string;
  };
 
  const signType = body.type === "WalletAddress" ? "evm" : "Email";
 
  const result = signMessage(
    process.env.TASKON_CLIENT_ID!,
    signType,
    body.account,
    process.env.TASKON_PRIVATE_KEY_BASE64!,
  );
 
  return Response.json(result);
}

Security Checklist

Keep private key in server-only environment variables
Never call signMessage in browser runtime
Return both signature and the original millisecond timestamp to frontend
Use HTTPS between frontend and your signature endpoint