I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well.
I'm building a web app where users can be in private groups. In order to join these groups, existing members can send to-be members a link to the group with a token in it. I'm wondering what precautions I should take regarding this token, so random people can't guess it and join a group. I'm currently generating a 256 bit random number (from a cryptographically secure random number generator) associated with the group that is then serialized to a string and sent as part of the URL (using HTTPS of course).
My question is, would I gain anything by hashing this token using e.g. bcrypt, and comparing the hash server-side in the group join operation? Would the answer to this change if I add a time-based component, so invitations are only valid for a certain time interval?