Smart Token Security Pipeline 2D: Sign, Verify, Expire, Revoke

Modern APIs authorize almost every request with a signed access token instead of a server-side session. This 2D lane diagram renders that verification pipeline top-down: a stream of tokens is issued on the left, then passes three independent security gates — an HMAC signature check that catches tampered payloads, an expiry check against the token's own TTL claim (with an optional clock-skew tolerance), and a revocation deny-list check for tokens an admin has killed early. Tokens that clear every gate ride onto a green "granted" platform on the right; any failure diverts a token into a red quarantine trough with its failure reason recorded. Drag the lane to scroll along the pipeline, and watch the stacked history chart below track how granted vs. failed traffic shifts as you move the sliders — including a gate-order toggle that shows why signature verification must always run first.