Filestack's docs are woefully lame for how to create security policies. Hopefully this helps.

filestack-security-policy-generation.js

// -------------------------------------------- SERVER SIDE
const base64 = require('base64-url')
const crypto = require('crypto')
const moment = require('moment')

function calculatePolicy(policy, secret) {
  const policyString = JSON.stringify(policy)
  const encodedPolicy = base64.encode(policyString)
  const signature = crypto.createHmac('sha256', secret).update(secret).digest('hex')

  return {
    policy: encodedPolicy,
    signature
  }
}

// this policy can be created dynamically either on the server or client
const basicSamplePolicy = {
  call: [ 'pick', 'list' ],
  expiry: moment().add(1, 'hour').valueOf()
}
const FILESTACK_SECRET = 'MY_FILESTACK_SECRET'
console.log(calculatePolicy(basicSamplePolicy, FILESTACK_SECRET))

// To use, you would put this `calculatePolicy` stuff behind an API route, so you could
// say something like `/policy` and it would return the encoded policy and signature
// which you would use to instantiate the filestack client.