The built-in single-node store: one ETS table owned by a GenServer.

Reads (get/1) hit ETS directly; writes and the atomicity-sensitive operations (update/2, take/1) serialize through the GenServer — login traffic is low-volume, so a single serialization point is the simplest correct design. Expired entries are treated as missing on read and swept every :sweep_interval_ms (default 30s).

Add it to your supervision tree:

children = [
  Keyfob.Store.ETS,
  ...
]

Single-node only: requests created on one node are invisible to another. For clusters, implement Keyfob.Store over shared storage.