Recipes
Whole tasks rather than single functions: what to call, in what order, and what to store between calls.
Each recipe is one whole job, written the way you'd ship it, with what goes wrong sitting right next to the code. The topic pages explain one function at a time; here you see them working together. Password storage and untrusted JSON have full walkthroughs on their own pages: Store passwords and Parse untrusted JSON.
Verify a webhook
Check the provider's signature over the raw body, refuse stale deliveries, and answer every refusal with the same 401.
Add two-factor login
Password, then authenticator code, each code accepted once, plus single-use recovery codes.
Issue API tokens
Generate a token, store only its digest, and find the row by that digest.
Derive keys from one secret
One root secret, one labeled key per purpose, imported once at start-up.
Use unsecure from a CDN
A plain HTML page that loads one module from esm.sh, pinned to a version.