refrakt/token

Secure, signed, expiring tokens for email verification, password reset, API authentication, and similar flows.

Usage

import refrakt/token

// Sign a token (e.g., user ID for email verification)
let tok = token.sign(secret, "user:verify", "42", max_age_seconds: 3600)

// Verify and extract the data
case token.verify(secret, "user:verify", tok, max_age_seconds: 3600) {
  Ok(data) -> // data == "42"
  Error(token.Expired) -> // token expired
  Error(token.Invalid) -> // signature mismatch or tampered
}

Types

TokenError

</>

Token verification errors.

pub type TokenError {
  Invalid
  Expired
  BadFormat
}

Constructors

```
Invalid
```
```
Expired
```
```
BadFormat
```

Values

sign

</>

pub fn sign(
  secret: String,
  purpose: String,
  data: String,
  max_age_seconds max_age: Int,
) -> String

Sign data into a secure token with a purpose and timestamp. The purpose prevents tokens from being used for different actions.

verify

</>

pub fn verify(
  secret: String,
  purpose: String,
  token: String,
  max_age_seconds max_age: Int,
) -> Result(String, TokenError)

Verify a token and extract the data. Returns Error if the token is expired, tampered, or has wrong purpose.