CAP never authorizes.
Strict unpadded base64url over the RFC 4648 URL-safe alphabet.
Decoding rejects padding, non-alphabet bytes, impossible lengths, and alternate spellings with non-zero pad bits by decode→re-encode comparison.
Summary
Functions
@spec decode(term()) :: {:ok, binary()} | {:error, CharterAgreementProtocol.Error.t()}
Decode canonical unpadded base64url.
Encode bytes as canonical unpadded base64url.