# `Chime.Token`
[🔗](https://github.com/hattoriai/chime/blob/v0.1.0-dev/lib/chime/token.ex#L1)

Signed tokens of a person, for the JSON API (`Chime.API`) where the
app's own session or token does not reach: an `EventSource` cannot send
an `authorization` header, and a page on another origin has no cookie
of the app's.

    # in a controller of the app, for its signed-in user
    json(conn, %{token: Chime.Token.sign("user:#{user.id}")})

The frontend gives it to the API as `Bearer <token>`, or as `?token=`
to `/stream`. `POST /token` of the API makes one for the person of the
request, too. A token is a `Phoenix.Token`, signed with the config's
`:secret_key_base` and a salt of Chime's own, valid for a day (`:max_age`
of `verify/2`). Make one on the server, for the person the page is for,
never from an id the browser sends.

The links to unsubscribe of the emails are tokens too, of another salt,
that do not expire.

# `sign`

```elixir
@spec sign(String.t()) :: String.t()
```

A token of a person, by their id.

# `verify`

```elixir
@spec verify(String.t(), keyword()) ::
  {:ok, String.t()} | {:error, :expired | :invalid}
```

The person of a token of `sign/1`: `{:ok, id}`, `{:error, :expired}`
past `:max_age` seconds (86400), or `{:error, :invalid}`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*