HMAC (hash-based message authentication code) is a secure system for protecting tokens.
It is based on a cryptographic hash function and incorporates a secret key known only to the API server. When used to authenticate tokens, HMAC produces a short authentication tag that is appended to the token.
If even a single bit of the token is altered, the tag will change, preventing the attacker from tampering with or faking new tokens. Furthermore, HMAC-SHA256 can immediately reject requests if the authentication tag is invalid or missing, without any database lookups, preventing any timing attacks.