Signed, single-use challenge tokens for multi-step auth flows on Node.js — carries userId / method / step / metadata across a redirect or a second request without a server-side session; HMAC-signed, expiring, optional IP-binding, single-use enforcement vi

Z-ZERO MCP Server — Secure JIT Virtual Card Payment tools for AI Agents (Claude, Cursor, AutoGPT) — Real Single-Use Virtual Cards, settled in USDC on Base

Signed, expiry-bound, single-use wallet auth proofs for BSV apps.

CLI for on-demand card credentials for AI agents — issued single-use cards or your own connected cards

own your agent secrets — an encrypted vault that hands agents scoped, short-lived, single-use leases instead of raw keys, and audits every access. Part of Own Your Stack.

Enables git to use credentials provided by environment variables. Useful for single-use environments, e.g. containerised utilities.

CLI for Snap — single-use virtual cards for AI agents.

FurlPay Travels — an MCP server composing Travala's Travel MCP (search) with FurlPay payment rails (x402/USDC on Base or single-use MCC-locked Visa VCN). Captures the 10% cbBTC developer rebate. Zero runtime dependencies.

Typed TypeScript client for the Ansem Pay API — mint single-use virtual Mastercards funded with USDC or $ANSEM on Solana. No KYC, no accounts.

Users, sessions, roles and pluggable login methods for Pattern — the optional identity brick. Opaque revocable cookie sessions (CAS-backed, sqlite or in-memory), a single-use token kernel (login/invite/bootstrap), a login page, and admin screens.

Invite → accept → expire flow — issue a single-use, expiring invitation to a resource and consume it, as a Convex component

Autospend MCP server — gives any MCP-compatible agent a request_card tool that issues scoped, single-use virtual cards through the Autospend platform.

Secure one-time passcodes for Node: hashed storage, constant-time verify, single use, and the three rate limits everyone forgets.

setup single-use (COSU) devices for android

Passwordless email-link auth for Node.js — HMAC-signed short-lived tokens (mlink_v1.<payload>.<hmac>), single-use enforcement, opt-in per-email rate limiting, hashed email in payload by default (SHA-256), configurable prefix, memory + Redis stores. Ships

Signed, short-lived, single-use authority objects for agentic money movement. Protocol spec + reference verifier.

Kiosk mode based on COSU (Corporate Owned Single Use)

Server-side state for SIWE (Sign-In with Ethereum) that viem/siwe deliberately leaves to the app: a single-use, TTL'd nonce store (atomic consume, delete-before-TTL-check so a race-loser cannot reuse) and an opaque CSPRNG session store bound to an address

Batch or single use renaming utility.

Short-lived, single-use CSRF tokens for Express — bound to browser context, built for multi-instance deployments. — a modern, dependency-free alternative to csurf