Solo Tokens

Solo TokensHand out the secret. Keep only the hash.

Tokens for reset links, invitations and sessions. Random secrets go to the user, only their hashes are stored, in Redis or in memory.

Get started
API reference
Solo Tokens
  • 🔒

    Only the hash is stored

    The secret goes into the link or the cookie, the store keeps its SHA-256. Whoever reads the store, a replica or a backup gets nothing they can sign in with.

  • ☝️

    Single use under load

    consume() finds and removes a token in one step, so two clicks on one reset link at the same moment cannot both pass. On Redis that step is one Lua script.

  • 🧹

    Revoke one or all

    End one token, or every token issued for a subject, such as all sessions after a password change.

  • 🧳

    Data travels with the token

    A small JSON-encodable array, such as an email address or a return URL, is stored with the token and comes back as it was issued.

  • 🙈

    Secrets stay out of traces

    Every parameter that carries a secret is marked

  • 🧪

    In-memory twin

    InMemoryTokenStore passes the same contract tests as the Redis store and takes a PSR-20 clock, so tests can move time.

php
use Solo\Tokens\RedisTokenStore;

$redis = new Redis();
$redis->connect('127.0.0.1', 6379);
$resets = new RedisTokenStore($redis, 'app:password-reset:');

$secret = $resets->issue($email, ttlSeconds: 3600);
$mailer->send($email, "https://example.com/reset?token={$secret}");

// Later, when the link comes back:
$token = $resets->consume($submittedToken) ?? throw new InvalidResetLink();
$users->setPassword($token->subject, $newPassword);

The store keeps only the hash of $secret. consume() returns the token once and null ever after. Read the getting-started guide for sessions, revoking and tokens kept in your own tables.

Installation ​

PHP 8.3+ is required. Composer installs psr/clock ^1.0 with the package. RedisTokenStore needs the redis extension and Redis 5.0 or later.

sh
composer require solophp/tokens

Continue with the getting-started guide.

MIT licensed.

Copyright © 2026 SoloPHP