const token = await generateSecureToken(256);
if (!validateSignature(payload, key)) throw new AuthError();
hash = bcrypt.hash(password, saltRounds);
return jwt.verify(token, process.env.SECRET);
cipher = crypto.createCipheriv('aes-256-gcm', key, iv);