I agree with nadir that this is not a space where you should 'roll your own' but I think it's long overdue that we start talking about how these things go wrong because it's the app developers that are creating these vulnerabilities and we need to learn how to stop doing that.
The biggest problem I see here is that you are storing the exact value needed to access the system. In a way, it's kind of like storing passwords in the clear. The issue is that there are many vulnerabilities in systems that allow attackers to get access to stored data like this. In this case, you were planning to store this in a file. A very common exploit is path/directory traversal. The 4th example shows a PHP example. You could move this into a database perhaps but PHP frameworks are notorious for SQL injection vulnerabilities due to the unwillingness or inability to use parameterized queries.
You need to operate under the presumption that these values might be retrieved and how to avoid them being used to access your system more broadly. In the case of passwords, if an attacker gets the shadow file full of hashes, they can't use them directly. A (ideally) costly process of cracking needs to be performed to get the actual passwords. But in your proposal, if the find a way to traverse the file system and get these files, it's basically game over: they've gained access.
Please don't take this to mean that if you've solved these issues, you have made your solution bullet-proof. Security is asymmetrical. An attacker just needs to find a hole or two. Th defender needs to plug all the holes. This is why it's best to leave the security tools to people who focus on that. I'm not saying you shouldn't try to understand, just that if you built your own, you are likely to make some of the same mistakes that have been made many times before.