DeviceAwareRefreshTokenStore

Optional capability for a Hazaar\Auth\Interface\RefreshTokenStore that can list and individually revoke a

interface DeviceAwareRefreshTokenStore extends \Hazaar\Auth\Interface\RefreshTokenStore

Extends: Hazaar\Auth\Interface\RefreshTokenStore

device/session, keyed by Hazaar\Auth\RefreshToken::sessionId rather than the rotating token itself.

Kept separate from the base Hazaar\Auth\Interface\RefreshTokenStore contract (mirrors how Hazaar\Auth\Interface\RevocableSessionBackend is kept separate from Hazaar\Auth\Interface\SessionBackend) so a minimal custom store isn't forced to implement device listing just to satisfy the base interface. Hazaar\Auth\Store\File\RefreshTokenStore and Hazaar\Auth\Store\Cache\RefreshTokenStore both implement this.

Methods

listDevices

Lists every outstanding device/session for an identity.

public listDevices(string $identity): array

Returns: array

Parameters

Parameter	Type	Description
$identity	string

revokeDevice

Revokes a single device/session outright (e.g. "log out this device"), identified by

public revokeDevice(string $identity, string $sessionId): void

Returns: void

Hazaar\Auth\RefreshToken::sessionId rather than the rotating token itself.

A no-op if the session is unknown or already revoked/consumed.

Parameters

Parameter	Type	Description
$identity	string
$sessionId	string

---

Generated by Hazaar API Doc Generator on Sun, 23 Aug 2026 10:49:44 +0000