# Recipes

> Whole tasks rather than single functions: what to call, in what order, and what to store between calls.

Each page here is one job, written the way you would actually ship it.

::card-group
::card{title="Verify a webhook" icon="i-lucide-webhook" to="/examples/webhook-verification"}
Read the raw body, check the signature, and keep the failure path shaped like the success path.
::
::card{title="Login with 2FA" icon="i-lucide-shield-user" to="/examples/two-factor-auth"}
Password, then a one-time password, with replay refused and the timing flat.
::
::card{title="Store passwords" icon="i-lucide-lock-keyhole" to="/examples/password-storage"}
Argon2 with a pepper, lazy rehashing, and the absent-account branch.
::
::card{title="Issue API tokens" icon="i-lucide-key" to="/examples/api-tokens"}
Generate, store only the digest, look up by digest, compare in constant time.
::
::card{title="Derive keys" icon="i-lucide-git-branch" to="/examples/key-derivation"}
One secret, many labelled keys, imported once.
::
::card{title="Parse untrusted JSON" icon="i-lucide-braces" to="/examples/safe-json"}
One call that parses and strips prototype-pollution keys.
::
::card{title="Import from a CDN" icon="i-lucide-globe" to="/examples/cdn-import"}
A browser page that downloads one module and nothing else.
::
::