RefreshTokenStore

Storage for opaque, revocable refresh tokens.

interface RefreshTokenStore

Implement this against whatever persistence an application already uses and bind it via the oauth.server.refresh_tokens config key. Hazaar\OAuth\Store\DBI\RefreshTokenStore provides a ready-to-use DBI-backed implementation.

Implementations must never persist token in plaintext — hash it (e.g. hash('sha256', ...)) before storage and compare hashes on lookup, the same way a password would be handled.

Methods

__construct

Construct the store.

public __construct(array $config): void

Parameters

Parameter	Type	Description
$config	array

save

Persists a newly-issued refresh token.

public save(RefreshToken $token): void

Returns: void

Parameters

Parameter	Type	Description
$token	Hazaar\OAuth\RefreshToken

consume

Validates a refresh token and revokes it in the same call.

public consume(string $token): ?RefreshToken

Returns: Hazaar\OAuth\RefreshToken

The authorization server rotates refresh tokens on every use (issuing a new one and discarding the old), so lookup and revocation are combined into a single atomic operation here to prevent a race where the same token is redeemed twice concurrently.

Parameters

Parameter	Type	Description
$token	string

revoke

Revokes a refresh token outright (e.g. on logout or explicit revocation), without rotating it.

public revoke(string $token): void

Returns: void

Parameters

Parameter	Type	Description
$token	string

---

Generated by Hazaar API Doc Generator on Sun, 23 Aug 2026 10:49:43 +0000