Inside GourdianToken

After sixteen months and seven v1 releases, GourdianToken v2.0.0 is out — a breaking release that makes identifiers opaque, adds sentinel errors and a real Close(), and fixes some genuinely nasty bugs. Here's everything that changed and how to migrate.

Refresh token rotation is only a security feature if it's atomic — two concurrent rotations of the same token must never both succeed. Here's how GourdianToken implements one compare-and-swap contract on Redis, MongoDB, SQL, and an in-memory map.

GourdianToken's refresh rotation had a subtle ordering bug: it destroyed the old token before the new one existed. One failed network call in between, and the user was permanently logged out. A war story about failure ordering in multi-step state changes.