package settings

import (
	"crypto/rand"
	"encoding/base64"
)

// GenerateSecret returns a new random secret suitable for HMAC signing.
func GenerateSecret() (string, error) {
	buf := make([]byte, 32)
	if _, err := rand.Read(buf); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(buf), nil
}