Opaque Access Tokens, Credential-Hash Storage, and Versioned Migrations

Context

JWT access tokens widen the leak surface and are hard to revoke instantly; storing tokens/secrets in plaintext means a database leak equals a credential leak.

Decision

Access tokens remain opaque random strings, validated by resource servers via introspection (RFC 7662); no JWT access token is introduced (the id_token remains a JWT); the database stores only SHA-256(token) and secret hashes; every schema change goes through append-only V### versioned migrations. Implementation note: the decision table originally said Argon2id, but what actually landed is PBKDF2-SHA256 with 310K iterations (PasswordHasher reserves an upgrade slot).

Consequences and Current State

The introspection/revocation endpoints are public contract; V001–V026 evolved append-only; migration immutability is enforced by the CI migration-check gate.