PHPackages                             lockerpm/locker-secrets - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. lockerpm/locker-secrets

ActiveLibrary

lockerpm/locker-secrets
=======================

Official PHP SDK for Locker Passwords & Secrets Management

v1.0.1(today)00Apache-2.0PHPPHP ^8.2

Since Aug 1Pushed todayCompare

[ Source](https://github.com/lockerpm/secrets-sdk-php)[ Packagist](https://packagist.org/packages/lockerpm/locker-secrets)[ RSS](/packages/lockerpm-locker-secrets/feed)WikiDiscussions main Synced today

READMEChangelogDependencies (4)Versions (2)Used By (0)

Locker Secrets PHP SDK
======================

[](#locker-secrets-php-sdk)

The official PHP SDK for Locker Passwords & Secrets Management.

This package is a typed PHP client for the stable Locker SDK protocol. It starts the Locker CLI as `locker sdk`, sends one JSON-RPC 2.0 request over stdin, reads one response from stdout, and never depends on human-facing CLI output.

Requirements
------------

[](#requirements)

- PHP 8.2 or later
- The JSON and Sodium extensions
- Linux or macOS with the `pcntl` and `posix` extensions
- The Locker CLI with SDK protocol v1 support
- A Locker access key ID and secret access key

The package has no third-party runtime dependency. Sodium verifies the Locker release signatures with the public key embedded in the SDK package.

Upgrading from the unfinished legacy package line is a breaking change. See [`MIGRATION.md`](MIGRATION.md).

Installation
------------

[](#installation)

```
composer require lockerpm/locker-secrets
```

Install the Locker CLI through the [signed release channel](https://locker.io/secrets/download), or configure the exact path to a trusted binary:

```
use Locker\ClientOptions;
use Locker\Locker;

$locker = new Locker(
    accessKeyId: $accessKeyId,
    secretAccessKey: $secretAccessKey,
    options: new ClientOptions(cliPath: '/opt/locker/bin/locker'),
);
```

Binary resolution is deterministic:

1. `ClientOptions::$cliPath`
2. `LOCKER_CLI_PATH`
3. the managed binary from Locker's [signed release channel](https://locker.io/secrets/download)

Explicit paths intentionally bypass managed updates, but must be absolute, regular, executable non-link files. Bare and relative values are rejected instead of being searched through ambient `PATH`. In managed mode, the SDK checks for a compatible release on first use and at most once every six hours. A network failure may reuse a previously verified cache; invalid signatures, mutated releases, and rollback attempts always fail closed. A missing or invalid bundled trust root also fails closed; the SDK never executes an ambient `locker` from `PATH`. Verified releases, state, and the interprocess lock are isolated below `~/.locker/sdk-cli/php/`, so another language SDK cannot overwrite this cache. On POSIX, every managed cache ancestor must be owned by the effective user and is revalidated at mode `0700` before updater state is used.

Legacy names such as `locker_secret` are never selected automatically. An explicit absolute path may use any filename, but protocol-v1 capability negotiation remains mandatory.

Scanner-compatible setup
------------------------

[](#scanner-compatible-setup)

The Locker scanner generates code against this public contract:

```