Skip to main content

PHP quickstart

PHP 8.1+, with Laravel and Symfony integrations.

composer require latchvector/sso
warning

This SDK requires firebase/php-jwt ^7.1. Everything below 7.0.0 is affected by CVE-2025-45769; do not work around Composer refusing older versions.

1. Protect an API​

use LatchVector\Sso\TokenVerifier;

$verifier = new TokenVerifier(
    issuer: 'https://sso.yourdomain.com',
    audience: 'https://api.yourcompany.com', // your registered identifier
    cache: $psr16Cache,                      // do not skip — see README
);

$principal = $verifier->verifyAuthorizationHeader(
    $request->getHeaderLine('Authorization'),
);

PHP dies at the end of every request, so a PSR-16 cache for the signing keys is required, not optional — the README explains why.

2. Log a user in​

use LatchVector\Sso\SsoClient;
use LatchVector\Sso\TokenPair;

$sso = new SsoClient('https://sso.yourdomain.com', 'https://api.yourcompany.com');
$result = $sso->login($email, $password);
if ($result instanceof TokenPair) {
    $access = $result->accessToken;
    $refresh = $result->refreshToken;
}

3. Manage resources​

use LatchVector\Sso\ManagementClient;

$mgmt = new ManagementClient($issuer, fn () => $currentAccessToken);
$mgmt->createUser(['organizationId' => $orgId, 'email' => $email, 'fullName' => $name]);
$mgmt->createApplication(['organizationId' => $orgId, 'identifier' => $id, 'name' => $name]);

Anything new is reachable via $mgmt->request(...).

:::tip Full reference The Packagist README covers multitenancy (Laravel), webhooks, and go-live checks. Full endpoint list: API reference. :::