FIGURED IT OUT: I was checking only the value of my var_dump, I wasn’t paying attention to data type – I was returning the hash in an array and passing that in to password_verify(), which won’t work. Once I isolated only the string, it worked.

I am using password_hash() to hash user passwords and attempting to use password_verify() on login, however password_verify() always returns false. I have tried using both PASSWORD_DEFAULT and PASSWORD_BCRYPT, same behavior.
I have seen in the solutions to others asking this question that the solution is either:

1. The password column in the database isn’t long enough to hold the hash – I’m using varchar(255) so that isn’t the problem.
2. The hashed password being returned from the database isn’t the same as the one that’s actually stored. I’ve used var_dump() to confirm that I’m returning the stored hash correctly.
3. Hashing the user-entered password before comparing it to the hashed password from the db – I’m using the raw input from the user (I know I will eventually need to sanitize input, just trying to get the basic auth flow working at this point).

Here is the code:

if(isset($_POST['loginUsername']) && isset($_POST['loginPassword'])) {
    $username = $_POST['loginUsername'];
    $password = $_POST['loginPassword'];
    $hashed_pw = getHashedPassword($username);

    if(password_verify($password, $hashed_pw)) {
        // Log the user in
        echo "logged in";
    } else {
        // Error message, limit retries
        echo "not logged in";
    }
}

if(isset($_POST['signupUsername']) && isset($_POST['signupEmail']) && isset($_POST['signupPassword'])) {
    $username = $_POST['signupUsername'];
    $email = $_POST['signupEmail'];
    $password = password_hash($_POST['signupPassword'], PASSWORD_DEFAULT);

    $user = new User($username, $email, $password);
    $user->saveNewUser();
}

If anyone can find the stupid mistake I’m making I will be very grateful!