@spec seal(
  %Tokenizer.Secret{
    allowed_host_pattern: term(),
    allowed_hosts: term(),
    bearer_auth: term(),
    fly_src_auth: term(),
    inject_hmac_processor: term(),
    inject_processor: term(),
    macaroon_auth: term()
  },
  iodata()
) :: {:ok, String.t()} | {:error, any()}