code: private String randomSecret() {
          byte[] r = new byte[32];
          new Random().nextBytes(r);
          return Base64.encodeToString(r, Base64.URL_SAFE | Base64.NO_WRAP | Base64.NO_PADDING);
      }
docs: /*
  client-side generation of credential token