RefreshTokenStore

Storage for opaque, revocable session refresh tokens.

interface RefreshTokenStore

Implement this against whatever persistence an application already uses and bind it via the refresh_tokens key of a Hazaar\Auth\Session\Backend\JWT backend's configuration. Hazaar\Auth\Store\File\RefreshTokenStore (the default) and Hazaar\Auth\Store\Cache\RefreshTokenStore provide ready-to-use implementations that need no app-owned schema or migration.

Implementations must never persist token in plaintext — hash it (e.g. hash('sha256', ...)) before storage and compare hashes on lookup, the same way a password would be handled.

Mirrors Hazaar\OAuth\Interface\RefreshTokenStore; kept as a separate interface because plain session auth has no OAuth client/scope/resource to bind a token to, and needs Hazaar\Auth\Interface\RefreshTokenStore::revokeAll (e.g. "log out everywhere" on a password change), which the OAuth store has no equivalent use for.

Methods

__construct

Construct the store.

public __construct(array $config): void

Parameters

Parameter	Type	Description
$config	array

save

Persists a newly-issued refresh token.

public save(RefreshToken $token): void

Returns: void

Parameters

Parameter	Type	Description
$token	Hazaar\Auth\RefreshToken

consume

Validates a refresh token and revokes it in the same call.

public consume(string $token): ?RefreshToken

Returns: Hazaar\Auth\RefreshToken

Refresh tokens are rotated on every use (issuing a new one and discarding the old), so lookup and revocation are combined into a single atomic operation here to prevent a race where the same token is redeemed twice concurrently.

Parameters

Parameter	Type	Description
$token	string

revoke

Revokes a single refresh token outright (e.g. on logout), without rotating it.

public revoke(string $token): void

Returns: void

Parameters

Parameter	Type	Description
$token	string

revokeAll

Revokes every outstanding refresh token for an identity (e.g. on password change, or an

public revokeAll(string $identity): void

Returns: void

explicit "log out of all other sessions" action).

Parameters

Parameter	Type	Description
$identity	string

---

Generated by Hazaar API Doc Generator on Sun, 23 Aug 2026 10:49:44 +0000