title: How to create a refresh token in plain php?
body: <p>I've been searching the web for an example/explanation on how to generate a refresh token myself. Not using any services like Oauth etc. Just in plain php.
  I found many info on how to use them, but not how to create one.</p>
  
  <p>I create a JWT like this:</p>
  
  <pre><code>$secret = "secret";
  
  $header = json_encode(['typ' =&gt; 'JWT', 'alg' =&gt; 'HS256']);
  
  function createJWT($user_id){
      $date = new DateTime();
      $timestamp = $date-&gt;getTimestamp();
  
      global $header;
      global $secret;
      $payload = ['user_id' =&gt; $user_id, 'iat'=&gt; $timestamp, 'exp'=&gt;$timestamp+10];
      $payload = json_encode( $payload );
      $base64UrlHeader = str_replace(['+','/','='], ['-','_',''], base64_encode($header));
      $base64UrlPayload = str_replace(['+','/','='], ['-','_',''], base64_encode($payload));
      $signature = hash_hmac('sha256', $base64UrlHeader . "." . $base64UrlPayload, $secret);
      $base64UrlSignature = str_replace(['+','/','='], ['-','_',''], base64_encode($signature));
      $JWT =$base64UrlHeader . '.' . $base64UrlPayload . '.' . $base64UrlSignature;
  
      return $JWT;
  }
  </code></pre>
  
  <p>And when looking at the jwt.io debugger it works fine.</p>
  
  <p>But since I want to use a refresh token so I can "create" more access tokens after they've expired I can't find any information on how to create such one.</p>
  
  <p>What i understand the access token is stored in local storage/cookie while the refresh token is store in a database. </p>
  
  <p>How do I create a refresh token, what info does it contain? I guess it's not just a random string. And what does the schema a of the database/table storing the refresh token look like?</p>