final class PasswordlessAuthenticationController
{
    public function __construct(
        private readonly UriGenerator $uri,
    ) {}

    public function __invoke(Request $request): Response
    {
        if (! $this->uri->hasValidSignature($request)) {
            return new Forbidden();
        }

        // Actual logic here...
    }
}

#[Get('/verify-email/{token}')]
#[ValidSignature]
public function verifyEmail(string $token): Response
{
    // This code only executes if the signature is valid
    // 403 Forbidden is returned automatically if invalid
}

// Generate URL
$url = signed_uri(
    action: [EmailVerificationController::class, 'verify'],
    userId: $user->id,
    email: $user->email,
);

// Controller - automatically validates signature
#[Get('/verify-email')]
#[ValidSignature]
public function verify(int $userId, string $email): Response
{
    // Safe to proceed - signature was validated
}

// Generate URL with 10-minute expiration
$url = temporary_signed_uri(
    action: PasswordResetController::class,
    duration: Duration::minutes(10),
    token: $resetToken,
);

// Controller - automatically validates signature AND expiration
#[Get('/reset-password/{token}')]
#[ValidSignature]
public function __invoke(string $token): Response
{
    // Safe to proceed - signature is valid and not expired
}