Checking what kind of token you receive probably helps before writing a validator

src/validator.py

@@ -2,26 +2,17 @@ from argon2 import PasswordHasher
 import re
 
 def is_valid_platform(platform) -> bool:
-	if platform not in ["ios","android","web"]:
+	if platform not in ["android"]:
 		return False
 	return True
 
 def is_valid_token(token: str) -> bool:
 	"""
-	Validate a push notification token.
+	Validates the format ExponentPushToken[<22-letter-long-string>]
-
-	Criteria:
-	- Must be a string
-	- Correct length (e.g., 140–200 chars)
-	- Only safe characters (alphanumeric, dash, underscore)
 	"""
-	if not isinstance(token, str):
-		return False
 
-	if not (140 <= len(token) <= 200):
+	pattern = r"^ExponentPushToken\[([A-Za-z]{22})\]$"
-		return False
+	if not re.match(pattern, token):
-
-	if not re.match(r'^[A-Za-z0-9\-_]+$', token):
 		return False
 	
 	return True