# `Issho.Token`
[🔗](https://github.com/hattoriai/issho/blob/v0.1.0/lib/issho/token.ex#L1)

Short-lived, signed credentials to join one room as one actor.

Your LiveView signs a token after it has authenticated the person and
checked they may join; the browser joins the room's channel with it.
The token holds the actor's identity (`Issho.Identity`, with your
`claims`) and what it may do: `:read` or `:write`. A read token never
writes, whatever the browser sends.

    token = Issho.Token.sign(MyApp.Issho, current_user, "board:42", can: :write)

Tokens are good for joining for the instance's `:token_max_age` (300
seconds). The browser renews them through the LiveView before then; a
session already joined stays until it leaves, its access is revoked
(`Issho.revoke/3`), or the policy refuses it.

# `sign`

```elixir
@spec sign(atom(), Issho.Actor.t() | Issho.Identity.t(), String.t(), keyword()) ::
  String.t()
```

Signs a token for the actor to join the room. Options: `:can` (`:write`
or `:read`, `:write` unless given), `:claims` (a small map of your own
for the policy) and `:on_behalf_of` (the actor an agent acts for).

# `verify`

```elixir
@spec verify(atom(), String.t(), String.t()) ::
  {:ok, Issho.Identity.t(), :read | :write}
  | {:error, :expired | :invalid | :other_room}
```

Verifies a token for the room. Gives `{:ok, identity, can}`, or
`{:error, :expired | :invalid | :other_room}`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*