Integrating secrets token generation with hmac.compare_digest for expiring credentials

Goal

Design an authentication flow that uses secrets.token_urlsafe for issuing short‑lived API tokens and hmac.compare_digest for constant‑time verification, while enforcing automatic expiration without external libraries.

Constraints

• Only the Python standard library may be used; third‑party packages such as bcrypt or argon2-cffi are excluded.
• The solution must run on Python 3.8+ where secrets is guaranteed.
• Token storage must remain minimal, avoiding a full database if possible.

Open questions

• What pattern allows the verifier to reject expired tokens using only hmac.compare_digest without storing issuance timestamps?
• Can a deterministic encoding embed expiry information into the token itself while preserving the entropy guarantees of secrets?
• How should token rotation be coordinated across multiple service instances without a shared secret store?