Workflow action

Crypto & IDs

ut_crypto

UUID v4/v7 and ULIDs, SHA hashes, HMAC webhook signatures with a stored secret, base64/hex/URL encoding, random and one-time codes, and HS256 JWTs.

Officialv1.0.010 functions
Download .utpkg 20 KBInstall in your workspace

About

What it does

Crypto & IDs gives workflows identifiers and cryptography from the server's secure random generator. Generate random UUID v4s or time-ordered UUID v7s and ULIDs that sort by creation time, unbiased random codes from alphabets without look-alike characters (grouped like ABCD-EFGH), and numeric one-time codes with an expiry time and a hash to store instead of the code. Hash text with SHA-256, SHA-512, SHA-384 or SHA-1 and encode or decode base64, base64url, hex and URL percent-encoding.

For integrations, HMAC signs a message with a key that an administrator stores once (hmac_key): the host computes the signature, so the key never reaches workflow builders or the action's code, and a received webhook signature is compared in constant time. Sign token and Verify token issue and check compact HS256 JSON Web Tokens with token_secret: expiry, not-before, issuer and audience are enforced, and invalid tokens come back with a reason instead of failing the workflow.

Good for

  • Verify the HMAC signature of an incoming webhook before processing it
  • Issue a signed, expiring link token for an external approver and check it when they respond
  • Generate voucher or reference codes and time-ordered IDs for new records

After installing

  1. Install the package: the action appears in Extensibility → Workflow actions and in the workflow designer's palette under Custom actions.
  2. For HMAC: in Extensibility → Workflow actions, open Crypto & IDs and set the hmac_key secret (e.g. your webhook provider's signing secret). For tokens: set token_secret to a long random value.
  3. Drag Crypto & IDs onto a workflow and choose the function. For webhooks, map Message to the raw request body and Signature to check to the signature header, then branch on {{prefix_matches}}.
  4. Try the included "Signed approval link (sample)" workflow from the API or its start form after setting token_secret: it signs a token for an approver, verifies it and hashes the request reference.

Examples

Real inputs, real outputs

Each example ran in the sandbox when this gallery was built; the outputs are exactly what the step returns.

SHA-256 of "abc" hash

Inputs

{
  "text": "abc",
  "algorithm": "SHA-256"
}

Outputs

{
  "hash": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
  "algorithm": "SHA-256"
}

Check a webhook signature hmac

Signed with the hmac_key secret (the example uses the value "example-secret").

Inputs

{
  "message": "{\"event\":\"invoice.paid\",\"id\":\"evt_1042\"}",
  "expected": "sha256=1c1b1b59b8b80733797d06dae9234186bd3e41395f81d2773aa87f70daeaa4b3"
}

Outputs

{
  "signature": "1c1b1b59b8b80733797d06dae9234186bd3e41395f81d2773aa87f70daeaa4b3",
  "matches": true
}

Verify a signed token verify_token

Signed with token_secret = "example-secret".

Inputs

{
  "issuer": "usertasks",
  "audience": "approvals",
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTQyIiwicm9sZSI6ImFwcHJvdmVyIiwiaXNzIjoidXNlcnRhc2tzIiwiYXVkIjoiYXBwcm92YWxzIn0.ViY7aLGdekI4TR6SYbUEvxrBc4VtgmtpczNL4qmy6YU"
}

Outputs

{
  "valid": true,
  "reason": "",
  "claims": {
    "sub": "user-42",
    "role": "approver",
    "iss": "usertasks",
    "aud": "approvals"
  },
  "expires_at": null
}

Base64 of UTF-8 text encode

Inputs

{
  "text": "Hello, Wörld & friends",
  "format": "base64"
}

Outputs

{
  "result": "SGVsbG8sIFfDtnJsZCAmIGZyaWVuZHM="
}

Decode a URL parameter decode

Inputs

{
  "text": "name%3DAroha%20Smith%26role%3Dapprover",
  "format": "url"
}

Outputs

{
  "result": "name=Aroha Smith&role=approver"
}

Reference

Functions, inputs and outputs

The designer generates each function's input panel from these declarations; outputs appear in the data picker with their types.

UUID uuid

Generate UUIDs: v4 (random) or v7 (time-ordered: sorts by creation time, good for database keys). v7 IDs from one call are strictly increasing.

Inputs

  • version choice · v4 / v7 — v4 random, or v7 time-ordered.
  • count integer — Number of UUIDs to generate (1–1000).
  • uppercase boolean — Upper-case hex digits.

Outputs

  • uuid string — The first (or only) UUID.
  • uuids list of strings — Every UUID generated.

ULID ulid

Generate ULIDs: 26-character, time-ordered, URL-safe IDs (Crockford base32). ULIDs from one call are strictly increasing.

Inputs

  • count integer — Number of ULIDs to generate (1–1000).

Outputs

  • ulid string — The first (or only) ULID.
  • ulids list of strings — Every ULID generated.

Hash hash

The SHA-256, SHA-512, SHA-384 or SHA-1 digest of a text (UTF-8), as hex, base64 or base64url. For fingerprints, de-duplication and integrity checks; do not use plain hashes for passwords.

Inputs

  • text text — The text to hash (UTF-8; empty text has a hash too).
  • algorithm choice · SHA-256 / SHA-512 / SHA-384 / SHA-1 — Digest algorithm.
  • encoding choice · hex / base64 / base64url — How the digest is written.

Outputs

  • hash string
  • algorithm string

HMAC signature hmac

Sign a message with HMAC using the hmac_key secret, or check a received signature (e.g. a webhook's X-Signature header) in constant time. The secret never enters the action's code.

Inputs

  • message text · required — The exact text to sign, e.g. the raw webhook body.
  • algorithm choice · SHA-256 / SHA-512 / SHA-384 / SHA-1 — HMAC hash.
  • encoding choice · hex / base64 / base64url — How the signature is written (match what the sender uses).
  • expected string — Optional: a received signature to compare with (a sha256= prefix is ignored).

Outputs

  • signature string
  • matches boolean — Whether Signature to check equals the computed signature (empty when none was given).

Encode encode

Encode text (UTF-8) as base64, base64url, hex or URL percent-encoding.

Inputs

  • text text · required — The text to encode.
  • format choice · base64 / base64url / hex / url — Encoding.

Outputs

  • result text

Decode decode

Decode base64, base64url, hex or URL percent-encoding back to text (UTF-8). Invalid input fails with a clear message.

Inputs

  • text text · required — The text to decode (whitespace is ignored for base64 and hex).
  • format choice · base64 / base64url / hex / url — Encoding.
  • plus_as_space boolean — URL format: decode + as a space (HTML form encoding).

Outputs

  • result text

Random code random_code

Generate unbiased random codes from an alphabet: digits, letters and digits, hex, or no look-alikes (no 0/O, 1/I/L) for codes people read and type. Optional grouping such as XXXX-XXXX.

Inputs

  • length integer — Characters per code, not counting separators (1–256).
  • alphabet choice · no_lookalikes / digits / alphanumeric / alphanumeric_upper / letters_upper / hex / … — Which characters to use.
  • custom_alphabet string — With Alphabet = Custom: the characters to use (at least 2).
  • count integer — Number of codes to generate (1–1000).
  • group_size integer — Insert the separator every N characters (0 = no grouping).
  • separator string — Placed between groups.

Outputs

  • code string — The first (or only) code.
  • codes list of strings — Every code generated.

One-time code otp

A numeric one-time code (e.g. for email or SMS verification) with its expiry time and SHA-256 hash: store the hash, not the code, and compare hashes when the user types it.

Inputs

  • digits integer — 4–10 digits.
  • expires_minutes integer — How long the code is valid.

Outputs

  • code string — The code (keeps leading zeros).
  • expires_at date & time — UTC instant.
  • code_hash string — SHA-256 hex of the code.

Sign token (JWT) sign_token

Create a compact HS256 JSON Web Token signed with the token_secret secret: your claims plus iat, exp (from Expires in), optional iss / aud / sub and a unique jti.

Inputs

  • claims object — The token's data, e.g. { "role": "approver", "request_id": "REQ-1042" }.
  • expires_minutes integer — Lifetime of the token; 0 for no expiry.
  • issuer string — Optional issuer claim.
  • audience string — Optional audience claim.
  • subject string — Optional subject claim, e.g. a user id.

Outputs

  • jwt string — header.payload.signature
  • expires_at date & time — UTC instant (empty without expiry).
  • claims object — Every claim in the token.

Verify token (JWT) verify_token

Check an HS256 token signed with token_secret: the signature (constant-time), expiry (exp) and not-before (nbf) with a leeway, and optionally the issuer and audience. Invalid tokens return valid = false and a reason instead of failing the step.

Inputs

  • jwt string · required — The token (a "Bearer " prefix is ignored).
  • issuer string — Optional: iss must equal this.
  • audience string — Optional: aud must equal or contain this.
  • leeway_seconds integer — Tolerance for exp and nbf.

Outputs

  • valid boolean
  • reason string — Why the token is not valid: malformed, unsupported algorithm, bad signature, expired, not yet valid, issuer or audience does not match (empty when valid).
  • claims object — The token's claims when the signature is valid (also when expired), else empty.
  • expires_at date & time — From exp (empty without expiry).

Network

None. The action cannot make requests.

Data and files

None. It only sees its inputs.

Secrets

Declared: secret://hmac_keysecret://token_secret— set once in Extensibility, stored encrypted, never shown again.

Install

Install it in your workspace

Works on UserTasks cloud and any self-hosted instance. The action lands in Extensibility → Workflow actions, enabled, with its sample workflow.

In the app

  1. Open Extensibility → Workflow actions → Browse gallery and choose Install on Crypto & IDs. Or download workflow-action-crypto-ids-1.0.0.utpkg and drag it onto Automations → Packages.
  2. The wizard verifies the checksum, every file hash and the signature, and shows what it adds.
  3. In Extensibility → Workflow actions → Manage → Access, set hmac_key and token_secret for the functions that need them.
  4. In the workflow designer, drag Crypto & IDs from Custom actions, pick a function and fill its inputs. Save & Test shows the typed outputs.

With the CLI

shell
curl -fLO https://usertasks.com/gallery/workflow-action-crypto-ids-1.0.0.utpkg
usertasks packages install workflow-action-crypto-ids-1.0.0.utpkg
usertasks activities test ut_crypto -f '{"operation":"uuid"}'

Verify the download

File SHA-256
b55b65f891b59019f04a64a34615c8c2e3ea588c2450ec0a209124e0a2b0c4be
Package checksum (what is signed)
sha256:86f9a2ef35eda492850d4f4328c8df1d30f9313ebed3364baa26e20f5c2e062d
Module SHA-256
23f2ecd97ba497b8a995a59f48345697550e24b5be1ac923d2c9dc8e642e437d
Signer
UserTasks Gallery · 49:f3:04:90:47:02:4d:07:28:61:3d:dc:bb:aa:db:11

More workflow actions

All actions