benecaster_token_invalid
Fires when a feed request presents a token that fails validation. Failure reasons include: the token hash does not match any record, the token has been revoked, or no matching token is found. This hook does not fire when a token is valid but the associated subscription is inactive.
Useful for security monitoring — repeated invalid token attempts against the same show may indicate token sharing, a revoked subscriber still using an old feed URL, or a credential-stuffing attempt. The `$token_prefix` parameter is safe to log; the first 8 characters of a token cannot be used to reconstruct the full credential or pass validation. Premium only: not registered when no valid license is active.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
$token |
string |
— | The token string that failed validation (partial prefix only, for logging) |
$show_id |
int|null |
— | ID of the show, if determinable from the request |
Examples
Log invalid attempts with IP
add_action( 'benecaster_token_invalid', function (
string $token_prefix,
int $show_id
) {
$ip = sanitize_text_field( $_SERVER['REMOTE_ADDR'] ?? 'unknown' );
error_log( sprintf(
'Benecaster: invalid token attempt — prefix=%s show=%d ip=%s',
$token_prefix,
$show_id,
$ip
) );
}, 10, 2 );Notes
Premium only: not registered when no valid license is active. $token_prefix is safe to log — it is the first 8 characters of the presented token and is not sufficient to reconstruct the full credential. Note: the YAML entry lists only one parameter named $token; the correct signature has two parameters: $token_prefix (string) and $show_id (int). The YAML parameter list needs updating.
