Smart Token Security Pipeline: Sign, Verify, Expire, Revoke

Modern APIs authorize almost every request with a signed access token instead of a server-side session. This simulator renders that verification pipeline in 3D: a stream of tokens is issued at the left, then passes three independent security gates — an HMAC signature check that catches tampered payloads, an expiry check against the token's own TTL claim, and a revocation deny-list check for tokens an admin has killed early. Tokens that clear all three gates ride onto a green "granted" platform; any failure diverts a token into a red quarantine trough with its failure reason recorded. Sliders control the token lifetime, issuance rate, how aggressively a simulated attacker tampers with payloads, and how fast security operations revokes suspicious tokens, so you can see directly how TTL length and revocation speed trade off against exposure window.