KemalIdentity::Accounts::ActionToken
A single-use, expiring grant: password reset, email confirmation, invitation.
The bearer holds a random secret; this is the server-side half, and it stores only the
digest. Every rule in KemalIdentity::OpaqueToken applies, and two more that only a
repository can enforce: it expires, and it is consumed atomically, so that two
concurrent requests cannot both succeed with the same link.
Why a reset link is not a session
A reset token authorises exactly one operation and dies. It never becomes a credential, is
never presented twice, and grants nothing beyond its purpose — which is why purpose is
part of the lookup and not just a label. A token issued to confirm an address must not be
redeemable to change a password, or an attacker who can trigger a confirmation email gets
an account takeover.