`js
var secret = tokens.secretSync()
var token = tokens.create(secret)
`

#### tokens.secret(callback)

Asynchronously create a new secret, which is a string. The secret is to
be kept on the server, typically stored in a server-side session for the
user. The secret should be at least per user.

`js
tokens.secret(function (err, secret) {
if (err) throw err
// do something with the secret
})
`

#### tokens.secret()

Asynchronously create a new secret and return a Promise. Please see
tokens.secret(callback) documentation for full details.

Note: To use promises in Node.js _prior to 0.12_, promises must be
"polyfilled" using global.Promise = require('bluebird').

`js
tokens.secret().then(function (secret) {
// do something with the secret
})
`

#### tokens.secretSync()

A synchronous version of tokens.secret(callback). Please see
tokens.secret(callback) documentation for full details.

`js
var secret = tokens.secretSync()
`

#### tokens.verify(secret, token)

Check whether a CSRF token is valid for the given secret, returning
a Boolean.

`js
if (!tokens.verify(secret, token)) {
throw new Error('invalid token!')
}
``

License

MIT

[coveralls-image]: https://badgen.net/coveralls/c/github/pillarjs/csrf/master
[coveralls-url]: https://coveralls.io/r/pillarjs/csrf?branch=master
[node-image]: https://badgen.net/npm/node/csrf
[node-url]: https://nodejs.org/en/download
[npm-downloads-image]: https://badgen.net/npm/dm/csrf
[npm-url]: https://npmjs.org/package/csrf
[npm-version-image]: https://badgen.net/npm/v/csrf
[travis-image]: https://badgen.net/travis/pillarjs/csrf/master
[travis-url]: https://travis-ci.org/pillarjs/csrf