Token Lifecycle Split & Verification

I. CRYPTO & SECURE STORAGE (SERVER-SIDE) II. APPLICATION & DELIVERY FLOW III. CLIENT STORAGE & SESSIONS 1. REG REQUEST 2. GENERATE TOKEN 3A. SHA-256 HASH 4A. DB (HASHED ONLY) 3B. EMAIL DELIVERY ❌ PLAIN DB STORE 5. VERIFY ENDPOINT 6. ISSUE SESSIONS COOKIE (HTTPONLY) AUTH HEADER REQUEST HASH SEND RAW UNSAFE PERSIST CLICK LINK COMPARE VERIFIED REJECTED