Generating Tokens

Token generation is handled by the Trongate_tokens module. This page shows you how to access it and create tokens for authenticated users.

No Module Loading Required

In Trongate v2, you don't need to explicitly load modules before using them.

Just call the module directly:

The framework's magic __get() method handles module loading automatically.

Method Name Changes from v1

All methods in the Trongate_tokens module have been renamed in v2. The underscore prefix is gone.

Generating Tokens

Use the generate_token() method to create authentication tokens.

Method Signature

Required Parameters

The $data array must contain:

• user_id (int) - The id from the trongate_users table

Optional Parameters

• expiry_date (int) - Unix timestamp for when the token expires. Default: current time + 86400 seconds (24 hours)
• set_cookie (bool) - If true, store token in a cookie. If false or omitted, store in session
• code (string) - Internal code for special use cases (rarely used)

Return Value

Returns a string containing the generated 32-character token.

Basic Example: Session Token

Generate a token that lasts 24 hours and stores in the session:

This is the most common pattern. The token:

• Expires in 24 hours (default)
• Stores in $_SESSION['trongatetoken']
• Stores in the trongate_tokens database table

Custom Expiry: 30-Day Token

For "remember me" functionality, create a longer-lived token:

Still stores in session by default.

Cookie Storage: Persistent Login

Store the token in a cookie so it persists across browser sessions:

The token now stores in $_COOKIE['trongatetoken'] and persists even after the browser closes.

Complete Login Example

Here's a realistic login controller that validates credentials and generates a token:

What Happens Behind the Scenes

When you call generate_token(), the framework:

1. Generates a random 32-character string using make_rand_str()
2. Sets the expiry date (either your custom value or default 86400 seconds)
3. Inserts a row into the trongate_tokens table with:
   • token - The random string
   • user_id - From your $data array
   • expiry_date - Unix timestamp
4. Stores the token on the user's device:
   • If set_cookie is true → stores in $_COOKIE['trongatetoken']
   • Otherwise → stores in $_SESSION['trongatetoken']
5. Returns the token string

Default Token Lifespan

If you don't specify an expiry_date, tokens default to 86400 seconds (24 hours).

This default is defined in the Trongate_tokens_model class:

You can modify this value if you want different default behavior.

Security Notes

• Never expose tokens in URLs - Always use sessions or cookies
• Use HTTPS - Tokens are random strings but not encrypted
• Set appropriate expiry dates - Shorter for sensitive operations, longer for convenience
• Hash passwords - Always use password_hash() before storing passwords in your database

Common Patterns

Standard Login (Session, 24 Hours)

Remember Me (Cookie, 30 Days)

Short-Lived Token (1 Hour)

What's Next

Now that you know how to generate tokens, the next page covers:

• Validating tokens with attempt_get_valid_token()
• Fetching user data from tokens
• Checking user levels