PHPackages                             torii/backend - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. torii/backend

ActiveLibrary[Authentication & Authorization](/categories/authentication)

torii/backend
=============

Backend SDK for torii — verify end-user JWTs without a per-request round trip, manage users from your PHP server.

v0.0.8(3w ago)00MITPHP ^8.2

Since Jun 26Compare

[ Source](https://github.com/Torii-ApS/torii-sdk-php)[ Packagist](https://packagist.org/packages/torii/backend)[ Docs](https://torii.so)[ RSS](/packages/torii-backend/feed)WikiDiscussions Synced 3w ago

READMEChangelog (2)Dependencies (26)Versions (7)Used By (0)

torii/backend
=============

[](#toriibackend)

Backend SDK for [torii](https://torii.so) — verify end-user JWTs without a per-request round trip and manage users from your PHP server.

> **v0.x — API may still change.**

Setup
-----

[](#setup)

1. Sign in to [app.torii.so](https://app.torii.so) and from your dashboard copy:

    - your **issuer URL** (e.g. `https://acme.torii.so`)
    - a **secret key** (`sk_test_…` for development, `sk_live_…` for production)
2. Install the SDK:

    ```
    composer require torii/backend
    ```

    Requires PHP 8.2+ with the `openssl`, `curl`, `json`, and `mbstring` extensions.
3. Verify an end-user JWT:

    ```
    use function Torii\Backend\verify_token;

    $auth = verify_token(
        token: $bearerToken,
        issuer: 'https://acme.torii.so',
    );

    echo $auth->userId, $auth->environmentId, $auth->emailVerified;
    ```

    The first call fetches the issuer's JWKS; subsequent calls reuse the cache and rotate keys automatically (handled by [`firebase/php-jwt`](https://github.com/firebase/php-jwt)'s `CachedKeySet`). No round trip per request. Pass a PSR-6 `CacheItemPoolInterface` via the `cache:` argument to share JWKS storage with Redis/Memcached.
4. Call the backend REST API:

    ```
    use Torii\Backend\Torii;

    $torii = Torii::create(secretKey: getenv('TORII_SECRET_KEY'));
    $user = $torii->users->get($userId);
    ```

Authenticate a request
----------------------

[](#authenticate-a-request)

```
use function Torii\Backend\authenticate_request;

// PSR-7 ServerRequestInterface, or any framework whose request exposes headers
$auth = authenticate_request($request, issuer: 'https://acme.torii.so');

// Or plain header arrays
$auth = authenticate_request(
    request: ['Authorization' => 'Bearer ' . $token],
    issuer: 'https://acme.torii.so',
);
```

Laravel
-------

[](#laravel)

Register the service provider (Laravel 11+ in `bootstrap/providers.php`):

```
return [
    // ...
    Torii\Backend\Laravel\ToriiServiceProvider::class,
];
```

Publish the config and set env vars:

```
php artisan vendor:publish --tag=torii-config
```

```
TORII_SECRET_KEY=sk_live_...
TORII_ISSUER=https://acme.torii.so
# Optional — defaults to https://api.torii.so
# TORII_API_URL=https://api.torii.so
```

Protect routes with the `RequireAuth` middleware:

```
use Torii\Backend\Laravel\Middleware\RequireAuth;

Route::middleware(RequireAuth::class)->get('/me', function (Request $request) {
    return [
        'user_id' => $request->torii_auth->userId,
        'env_id' => $request->torii_auth->environmentId,
    ];
});
```

On failure the middleware returns `401` with:

```
{ "error": { "code": "authentication_failed", "message": "..." } }
```

REST client
-----------

[](#rest-client)

```
use Torii\Backend\Patch;

$page = $torii->users->list(limit: 50);
$user = $torii->users->create(['email' => 'x@y.com', 'name' => 'Ada']);
$torii->users->ban($user->getId());

$sessions = $torii->sessions->listForUser($user->getId());
$torii->sessions->revokeAllForUser($user->getId());
```

### Updating users (tri-state PATCH)

[](#updating-users-tri-state-patch)

PHP arrays can't natively distinguish "leave this field alone" from "set this field to null", so `Users::update()` takes an array of `Patch` instances:

```
use Torii\Backend\Patch;

$torii->users->update($user->getId(), [
    'name'  => Patch::set('Ada Lovelace'), // update field
    'phone' => Patch::set(null),           // explicitly null on the server
    // omit a key entirely → server leaves that field alone
]);
```

- `Patch::set($value)` — server updates the field to `$value`.
- `Patch::set(null)` — server clears the field (sends JSON `null`).
- Omit the key from the patch array entirely — server leaves the field alone.

The REST client is generated by [openapi-generator-cli](https://openapi-generator.tech/) from `spec/server-v1.json`. To regenerate after a spec change:

```
npx -y @openapitools/openapi-generator-cli generate \
  -i spec/server-v1.json \
  -g php \
  -o src/Generated \
  --additional-properties=invokerPackage=Torii\\Backend\\Generated,packageName=torii-backend-generated
# Delete docs/, test/, composer.json, README.md, .travis.yml, .openapi-generator/, etc. afterwards.
```

Tests
-----

[](#tests)

```
composer install
vendor/bin/phpunit
```

Tests spin up an in-process `php -S` server that serves a JWKS document signed by a fresh ES256 keypair, then exercise the verifier against it.

License
-------

[](#license)

MIT

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance94

Actively maintained with recent releases

Popularity0

Limited adoption so far

Community2

Small or concentrated contributor base

Maturity40

Maturing project, gaining track record

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~10 days

Total

5

Last Release

26d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/832698?v=4)[Yoshimitsu Torii](/maintainers/Torii)[@torii](https://github.com/torii)

---

Tags

jwtlaravelsdkauthtorii

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/torii-backend/health.svg)

```
[![Health](https://phpackages.com/badges/torii-backend/health.svg)](https://phpackages.com/packages/torii-backend)
```

###  Alternatives

[tempest/framework

The PHP framework that gets out of your way.

2.2k34.4k16](/packages/tempest-framework)[aws/aws-sdk-php

AWS SDK for PHP - Use Amazon Web Services in your PHP project

6.2k543.5M2.7k](/packages/aws-aws-sdk-php)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

585.6M600](/packages/shopware-core)[google/auth

Google Auth Library for PHP

1.4k294.2M224](/packages/google-auth)[shopware/platform

The Shopware e-commerce core

3.4k1.5M3](/packages/shopware-platform)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)