 
   ## Options
 
+    * `:key_iterations` - option passed to `Plug.Crypto.KeyGenerator`
+      when generating the encryption and signing keys. Defaults to 1000
+    * `:key_length` - option passed to `Plug.Crypto.KeyGenerator`
+      when generating the encryption and signing keys. Defaults to 32
+    * `:key_digest` - option passed to `Plug.Crypto.KeyGenerator`
+      when generating the encryption and signing keys. Defaults to `:sha256`
     * `:max_age` - verifies the token only if it has been generated
       "max age" ago in seconds. A reasonable value is 1 day (86400
       seconds)
-    * `:key_iterations` - option passed to `Plug.Crypto.KeyGenerator`
-      when generating the encryption and signing keys. Defaults to 1000
-    * `:key_length` - option passed to `Plug.Crypto.KeyGenerator`
-      when generating the encryption and signing keys. Defaults to 32
-    * `:key_digest` - option passed to `Plug.Crypto.KeyGenerator`
-      when generating the encryption and signing keys. Defaults to `:sha256`
-
-  """
+
+  """
+  @spec verify(context, binary, binary, [shared_opt | max_age_opt]) ::
+          {:ok, term} | {:error, :expired | :invalid | :missing}
   def verify(context, salt, token, opts \\ []) when is_binary(salt) do
     context
     |> get_key_base()

      Defaults to `System.system_time(:second)`

  """
  def encrypt(context, secret, data, opts \\ []) when is_binary(secret) do
    context
    |> get_key_base()


  ## Options

    * `:key_iterations` - option passed to `Plug.Crypto.KeyGenerator`
      when generating the encryption and signing keys. Defaults to 1000
    * `:key_length` - option passed to `Plug.Crypto.KeyGenerator`
      when generating the encryption and signing keys. Defaults to 32
    * `:key_digest` - option passed to `Plug.Crypto.KeyGenerator`
      when generating the encryption and signing keys. Defaults to `:sha256`
    * `:max_age` - verifies the token only if it has been generated
      "max age" ago in seconds. Defaults to the max age signed in the
      token (86400)
  """
  @spec decrypt(context, binary, binary, [shared_opt | max_age_opt]) :: term()
  def decrypt(context, secret, token, opts \\ []) when is_binary(secret) do
    context
    |> get_key_base()
