Fix base64url secret decoding in HMAC signing

[powfan]

Summary

• /auth/api-key may return secret as base64url (may contain _ / -, padding omitted).
• base64ToArrayBuffer fed it directly to atob, which only accepts standard base64, causing InvalidCharacterError when the secret includes url-safe chars.
• Normalize url-safe base64 (convert -/_ and pad to multiple of 4) before decoding so the same secret works across runtimes.

Testing

• Node / Bun: deriveApiKey + createAndPostOrder no longer throw InvalidCharacterError.
• Standard base64 secrets still decode correctly; only input normalization changed, signature generation is otherwise unchanged.

---

Note

Normalize base64url secrets (convert -/_ and add padding) before atob in base64ToArrayBuffer to prevent decode errors.

• Signing/HMAC:
  • Update base64ToArrayBuffer in src/signing/hmac.ts to normalize base64url (replace -/_, add padding) before decoding with atob, ensuring secrets decode consistently across runtimes.

^{Written by Cursor Bugbot for commit 541f904. This will update automatically on new commits. Configure here.}

[bh1337x]

I was facing the same issue and it appears that this is the correct solution.