PHPackages                             paynl/request-signing - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. paynl/request-signing

ActiveLibrary[Security](/categories/security)

paynl/request-signing
=====================

A package to sign and verify request sent by PAY.

1.0.6(2y ago)015.3k↓46.3%[1 issues](https://github.com/paynl/request-signing/issues)proprietaryPHPPHP ^7.4 | ^8

Since Nov 28Pushed 2y ago3 watchersCompare

[ Source](https://github.com/paynl/request-signing)[ Packagist](https://packagist.org/packages/paynl/request-signing)[ RSS](/packages/paynl-request-signing/feed)WikiDiscussions main Synced 2d ago

READMEChangelog (7)Dependencies (8)Versions (8)Used By (0)

Request Signing
===============

[](#request-signing)

[![Static Code Analysis](https://github.com/paynl/request-signing/actions/workflows/code-analysis.yaml/badge.svg)](https://github.com/paynl/request-signing/actions/workflows/code-analysis.yaml)[![PHPUnit tests](https://github.com/paynl/request-signing/actions/workflows/phpunit.yaml/badge.svg)](https://github.com/paynl/request-signing/actions/workflows/phpunit.yaml)[![Coverage Status](https://camo.githubusercontent.com/0fafc125818c8db63c071e3e651c547a024f30c38ecb83296eab49795307184b/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f7061796e6c2f726571756573742d7369676e696e672f62616467652e7376673f6272616e63683d6d61696e)](https://coveralls.io/github/paynl/request-signing?branch=main)

This package adds functionality to sign & verify requests sent by the Pay. platform.

Requirements
------------

[](#requirements)

To install this package you need:

- PHP >= 7.4;
- composer.

Installation
------------

[](#installation)

```
composer require paynl/request-signing

```

Usage
-----

[](#usage)

The `PayNL\RequestSigning\RequestSigningService` simplifies both signing and verifying requests, avoiding the need for manual class instantiation.

The constructor function of this service requires an array of *SigningMethods* that you wish to support. Each signing method has different needs and functionality, and which one(s) you opt to support falls under your discretion.

By providing the service with the array of these chosen methods, the service can handle the configuration and functionality. This decouples the setup process from your main application logic, allowing a more streamlined integration.

### Signing

[](#signing)

The below code snippet shows the basis of signing a request using this package:

```
use PayNL\RequestSigning\RequestSigningService;
use PayNL\RequestSigning\Constant\SignatureMethodEnum;
use PayNL\RequestSigning\Methods\HmacSignature;

// Instantiate the RequestSigningService by providing it with your supported SigningMethods
$signingService = new RequestSigningService([
    new HmacSignature(
        new SignatureKeyRepository() // Your implementation of the HmacSignatureKeyRepositoryInterface
    )
]);

// Create your PSR Request, in this example we use the Nyholm PSR7 Request
$request = new \Nyholm\Psr7\Request('POST', 'https://pay.nl', [], '{"hello": "world"}')

// Sign the request providing the id of the key you want to use, the algorithm and the signature method
// This will return the given request with the signature headers attached to it
$signedRequest = $signingService->sign($request, 'SL-1234-1234', 'sha512', SignatureMethodEnum::HMAC);
```

### Verify

[](#verify)

The below code snippet shows the basis of verifying a request signed using the above-mentioned method:

```
use PayNL\RequestSigning\RequestSigningService;

// Instantiate the RequestSigningService by providing it with your supported SigningMethods
$signingService = new RequestSigningService([
    new HmacSignature(
        new SignatureKeyRepository() // Your implementation of the HmacSignatureKeyRepositoryInterface
    )
]);

// Retrieve your request, in this example we'll use the paynl/psr-server-request package to create a PSR Server Request from the PHP Global Variables
$request = create_psr_server_request();

// Pass this request to the verify method. The request argument is optional, if not provided it will attempt to create a request using the above-mentioned method.
$requestValid = $signingService->verify($request);
```

### Exception handling

[](#exception-handling)

The request signing service and the underlying signing / verifying methods may throw exceptions when unexpected values are encountered, these are:

- SignatureKeyNotFound, this exception must be thrown when the implementation of the `PayNL\RequestSigning\Repository\SignatureKeyRepositoryInterface` can not find the key based on the provided id;
- UnknownSigningMethodException, this exception will be thrown by the signing / verifying methods when they are requested to sign / verify a request with an algorithm they do not support;
- UnsupportedHashingAlgorithmException, this exception will be thrown by the `PayNL\RequestSigning\RequestSigningService` when it is requested to sign / verify a request with a method it doesn't support.

### Supported Signing / Verifying methods

[](#supported-signing--verifying-methods)

#### HMAC

[](#hmac)

The `PayNL\RequestSigning\Methods\HmacSignature` class enables the signing and verification of requests made with HMAC signatures. To utilize this class's method, a single argument is required for its constructor. This argument is of type `PayNL\RequestSigning\Repository\HmacSignatureKeyRepositoryInterface`.

*That is all you need to know to integrate this package, happy coding!*

###  Health Score

28

—

LowBetter than 52% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity26

Limited adoption so far

Community10

Small or concentrated contributor base

Maturity47

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 56.3% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~11 days

Recently: every ~17 days

Total

7

Last Release

879d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/3de4fdf653f1c9f2fd2fd25bb1ee8c5cfc05051f17a41759099e44fc47f6a089?d=identicon)[paynl](/maintainers/paynl)

---

Top Contributors

[![kjansenpay](https://avatars.githubusercontent.com/u/151923535?v=4)](https://github.com/kjansenpay "kjansenpay (9 commits)")[![paynl-wesley](https://avatars.githubusercontent.com/u/60603462?v=4)](https://github.com/paynl-wesley "paynl-wesley (7 commits)")

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StylePHP\_CodeSniffer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/paynl-request-signing/health.svg)

```
[![Health](https://phpackages.com/badges/paynl-request-signing/health.svg)](https://phpackages.com/packages/paynl-request-signing)
```

###  Alternatives

[guzzlehttp/psr7

PSR-7 message implementation that also provides common utility methods

8.0k1.1B4.0k](/packages/guzzlehttp-psr7)[tempest/framework

The PHP framework that gets out of your way.

2.2k34.4k15](/packages/tempest-framework)[aws/aws-sdk-php

AWS SDK for PHP - Use Amazon Web Services in your PHP project

6.3k543.5M2.6k](/packages/aws-aws-sdk-php)[cakephp/cakephp

The CakePHP framework

8.9k19.5M1.8k](/packages/cakephp-cakephp)[flow-php/flow

PHP ETL - Extract Transform Load - Data processing framework

85036.3k](/packages/flow-php-flow)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)