public function verify(string $secret): bool
    {
        try {
            $withoutSig = substr($this->token, 0, strrpos($this->token, '.'));
            $expected = hash_hmac(self::HASH_HMAC_ALGO, $withoutSig, $secret, true);
            return hash_equals($expected, $this->signature);
        } catch (\Throwable $e) {
            return false;
        }
    }