I'm creating a JWT authentication system that needs a secret key for the digital signature. I'm using HMAC SHA256.
After reading the accepted answer here, I decided to use a 128-bit key. I would like to store this in my API's configuration as plain-text, so I used PHP to generate a 16-byte key and then base64 encoded it.
I'm not a cryptography expert, and I can't seem to find whether or not I can directly use the string resulting from the base64 encoding, or if I need to decode and use the binary.