Skip to content
Corex

TokenSigner

Corex\Newsletter\TokenSigner · class · Add-ons layer

Signs and verifies a payload with an HMAC over a config secret (URL-safe base64). Used for the confirm and unsubscribe links — a tampered token verifies to null (fail-closed), and there is no email enumeration. Pure; constant-time compare.

Public API

Section titled “Public API”

__construct(string $secret)

Section titled “__construct(string $secret)”

sign(string $payload): string

Section titled “sign(string $payload): string”

verify(string $token): ?string

Section titled “verify(string $token): ?string”