PHPackages                             devlin/myinfo-singpass-laravel - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [API Development](/categories/api)
4. /
5. devlin/myinfo-singpass-laravel

ActiveLibrary[API Development](/categories/api)

devlin/myinfo-singpass-laravel
==============================

PHP package for Singpass/Myinfo v5 OIDC FAPI 2.0 integrations.

v1.0.1(2mo ago)26proprietaryPHPPHP >=7.4

Since Mar 3Pushed 1mo agoCompare

[ Source](https://github.com/dev-lin2/myinfo_singpass_php)[ Packagist](https://packagist.org/packages/devlin/myinfo-singpass-laravel)[ RSS](/packages/devlin-myinfo-singpass-laravel/feed)WikiDiscussions master Synced 1mo ago

READMEChangelogDependencies (5)Versions (4)Used By (0)

MyInfo Singpass Package (FAPI 2.0 Only)
=======================================

[](#myinfo-singpass-package-fapi-20-only)

PHP package for Singpass / Myinfo v5 integration using OIDC + FAPI 2.0 profile.

Installation
------------

[](#installation)

`composer require devlin/myinfo-singpass-laravel`

Reference
---------

[](#reference)

- Official integration guide:

Scope
-----

[](#scope)

This package now supports only the modern FAPI 2.0 flow:

- Pushed Authorization Request (PAR)
- PKCE (`S256`)
- DPoP
- `private_key_jwt` client authentication
- Encrypted + signed `id_token` validation
- `/userinfo` retrieval with `Authorization: DPoP `

Legacy MyInfo `/com/v3/*` flow is removed.

Required Environment Variables
------------------------------

[](#required-environment-variables)

```
MYINFO_CLIENT_ID=...
MYINFO_REDIRECT_URI=http://localhost:8080/myinfo/callback
```

Recommended Environment Variables
---------------------------------

[](#recommended-environment-variables)

```
MYINFO_ISSUER_URL=https://stg-id.singpass.gov.sg/fapi
MYINFO_SCOPES=openid uinfin name
MYINFO_TIMEOUT_MS=10000
```

Generating JWK Key Files
------------------------

[](#generating-jwk-key-files)

This package requires JWK key files for signing and encryption. If you don't have these yet, you can generate them using [`jwk-cli-tool`](https://www.npmjs.com/package/jwk-cli-tool) — an interactive CLI for generating PEM and JWK files.

```
npx jwk-cli-tool
```

The tool will guide you through:

1. **Generate PEM Key Pairs** — choose your algorithm (`ES256`, `ES384`, `ES512`, `RS256`, `RS384`, `RS512`) to produce `.pem` files
2. **Generate JWK JSON Files** — convert PEM keys to JWK format, set the key use (`sig` or `enc`), and assign a key ID

Run it twice — once for your **signing key** (`sig`) and once for your **encryption key** (`enc`) — then reference the output files in the env vars below.

> Requires Node.js 18+.

Key Configuration (choose one)
------------------------------

[](#key-configuration-choose-one)

### Option A: Singpass config JSON (recommended)

[](#option-a-singpass-config-json-recommended)

```
MYINFO_OIDC_CONFIG_PATH=./config/singpass-config.json
```

Expected JSON fields are `CLIENT_ID`, `REDIRECT_URI`, `ISSUER_URL`, and `KEYS`.

### Option B: explicit JWK env values

[](#option-b-explicit-jwk-env-values)

```
MYINFO_OIDC_PRIVATE_SIG_JWK_PATH=./myinfo/private_sig.jwk.json
MYINFO_OIDC_PUBLIC_SIG_JWK_PATH=./myinfo/public_sig.jwk.json
MYINFO_OIDC_PRIVATE_ENC_JWK_PATH=./myinfo/private_enc.jwk.json
```

Optional Reliability Settings
-----------------------------

[](#optional-reliability-settings)

```
MYINFO_OIDC_RETRY_ATTEMPTS=3
MYINFO_OIDC_RETRY_BACKOFF_MS=250
MYINFO_OIDC_CLIENT_ASSERTION_AUDIENCE=
```

`MYINFO_OIDC_CLIENT_ASSERTION_AUDIENCE` is optional. If empty, the package uses OIDC discovery issuer.

Optional Signature Verification Key Override
--------------------------------------------

[](#optional-signature-verification-key-override)

By default, the package verifies ID token and UserInfo signatures using the issuer discovery `jwks_uri`.

If you want to pin verification keys locally, set either:

```
MYINFO_OIDC_VERIFICATION_JWKS_PATH=./myinfo/myinfo_pub.jwk.json
```

or

```
MYINFO_OIDC_VERIFICATION_JWKS_JSON={...}
```

Accepted formats:

- JWKS object: `{ "keys": [ ... ] }`
- single JWK object
- array of JWK objects

Minimal Usage
-------------

[](#minimal-usage)

```
use Illuminate\Support\Str;
use MyInfo\Laravel\Facades\MyInfo;

// Redirect step
$state = Str::random(32);
$nonce = Str::random(32);
$codeVerifier = rtrim(strtr(base64_encode(random_bytes(64)), '+/', '-_'), '=');

session([
    'myinfo_state_'.$state => [
        'code_verifier' => $codeVerifier,
        'nonce' => $nonce,
    ],
]);

$url = MyInfo::buildAuthorizeUrl([
    'state' => $state,
    'nonce' => $nonce,
    'code_verifier' => $codeVerifier,
]);

return redirect()->away($url);
```

```
use MyInfo\Laravel\Facades\MyInfo;

// Callback step
$code = (string) request('code', '');
$state = (string) request('state', '');
$ctx = (array) session('myinfo_state_'.$state, []);
session()->forget('myinfo_state_'.$state);

$token = MyInfo::exchangeToken($code, null, [
    'code_verifier' => (string) ($ctx['code_verifier'] ?? ''),
    'nonce' => (string) ($ctx['nonce'] ?? ''),
]);

// id_token claims are already verified (iss, aud, exp, nonce)
$idTokenClaims = $token->getIdTokenClaims();

// Fetch Myinfo user data from /userinfo
$person = MyInfo::getPerson($token->getValue())->toArray();
```

Runtime Behavior
----------------

[](#runtime-behavior)

- PAR is always used.
- DPoP is always used for PAR, token, and userinfo calls.
- `token_type` must be `DPoP`.
- `openid` must be present in requested scopes.
- `id_token` claims are validated: `iss`, `aud`, `exp`, `nonce`.

Demo
----

[](#demo)

Look for a quick demo here. [https://github.com/dev-lin2/myinfo\_singpass\_php\_demo](https://github.com/dev-lin2/myinfo_singpass_php_demo)

###  Health Score

36

—

LowBetter than 82% of packages

Maintenance89

Actively maintained with recent releases

Popularity8

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity36

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

69d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/88b82e9ed6efa77adc587ad3ea19e096353a21573896333c81dabc085add8616?d=identicon)[dev-lin2](/maintainers/dev-lin2)

---

Top Contributors

[![dev-lin2](https://avatars.githubusercontent.com/u/83569604?v=4)](https://github.com/dev-lin2 "dev-lin2 (16 commits)")

### Embed Badge

![Health badge](/badges/devlin-myinfo-singpass-laravel/health.svg)

```
[![Health](https://phpackages.com/badges/devlin-myinfo-singpass-laravel/health.svg)](https://phpackages.com/packages/devlin-myinfo-singpass-laravel)
```

###  Alternatives

[statamic/cms

The Statamic CMS Core Package

4.8k3.2M720](/packages/statamic-cms)[wheelpros/fitment-platform-api

Magento 2 (Open Source)

12.1k1.2k](/packages/wheelpros-fitment-platform-api)[ashallendesign/laravel-exchange-rates

A wrapper package for interacting with the exchangeratesapi.io API.

485677.8k](/packages/ashallendesign-laravel-exchange-rates)[tencentcloud/tencentcloud-sdk-php

TencentCloudApi php sdk

3731.2M42](/packages/tencentcloud-tencentcloud-sdk-php)[vluzrmos/slack-api

Wrapper for Slack.com WEB API.

102589.1k3](/packages/vluzrmos-slack-api)[smodav/mpesa

M-Pesa API implementation

16363.7k1](/packages/smodav-mpesa)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)