v1.0.0

First release: tokens for reset links, invitations and sessions. The secret goes to the user, the store keeps only its SHA-256.

Added

• TokenStore interface: issue(), find(), consume(), revoke() and revokeAll().
• RedisTokenStore: one Lua script per operation on the Redis clock, so consume() hands a token to one of concurrent callers and expiresAt is the moment Redis ends the token. A subject's index drops ended tokens on every issue.
• InMemoryTokenStore: the same contract in process memory, with a PSR-20 clock and purgeExpired().
• Secret: random hex secrets (32–64 bytes) and their hashes, for tokens kept in your own tables.
• Token: the subject, data and expiry of a live token.

Internal

• One contract test suite runs against both stores. The Redis suite also covers stored hashes, key expiry, damaged records, the client key prefix and 20 processes consuming one token at once. CI runs PHP 8.3, 8.4 and 8.5 with Redis 7.4.

Docs

• Guide, API reference and behavior details at https://solophp.github.io/Tokens/

⚠️ RedisTokenStore needs Redis 5.0+, a single server (not Redis Cluster) and a connection without OPT_SERIALIZER or OPT_COMPRESSION.