export declare function extractTokenFromHeader(headerValue: string | undefined, scheme?: string): string | null;
/**
 * Verifies the HMAC signature of a token and returns its decoded payload.
 *
 * The token is expected to be in the format `header.payload.signature`, where each part is base64url-encoded.
 * The function recalculates the signature using the provided secret and compares it to the signature in the token.
 * If the signature is valid, the payload is decoded and parsed as JSON.
 *
 * @param token - The HMAC-signed token string to verify.
 * @param secret - The secret key used to verify the HMAC signature.
 * @returns The decoded payload as an object.
 * @throws {Error} If the token's signature is invalid or if the payload cannot be parsed.
 */
export declare function verifyHMAC(token: string, secret: string): any;
//# sourceMappingURL=utils.d.ts.map