Authorizing a gated resource without login
Use the same single-use, hashed-at-rest token to authorize one specific resource — a one-time download or a gated view — without creating a session and without a serialized payload.
Extension points
Take over the post-verification flow, react to events, swap the collaborators, and gate requests with a CAPTCHA.
Keeping the token table small
Every request inserts a row and consumption only marks it consumed — schedule the bundled purge command to delete expired and consumed tokens.
Running under multi-tenancy
Re-define the package's named rate limiters after a per-tenant cache swap, and give the routes the middleware that puts them on the tenant connection.