PHPackages twogether/laravel-url-signer - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Utility & Helpers](/categories/utility) 4. / 5. twogether/laravel-url-signer ActiveLibrary[Utility & Helpers](/categories/utility) twogether/laravel-url-signer ============================ Signs and validates URLs with public/private keys 2.5.2(1y ago)062.7k↓56.8%11MITPHPPHP ^7.1|^8.0 Since Apr 27Pushed 1y ago2 watchersCompare [ Source](https://github.com/Twogether/laravel-url-signer)[ Packagist](https://packagist.org/packages/twogether/laravel-url-signer)[ RSS](/packages/twogether-laravel-url-signer/feed)WikiDiscussions master Synced 2d ago READMEChangelogDependencies (2)Versions (20)Used By (1) URL Signer ========== [](#url-signer) Signs and validates URLs with public/private keys. This is used so that a *Source* application can make one time calls to a *Target*application and the Target can verify they're legit. This package is designed for Laravel, but can be used by other things with some additional configuration. Installing ---------- [](#installing) First install the package. If you're using Laravel, it adds an artisan command which you can use to generate a key pair if you need one. `php artisan twogether:generate-key-pair` You'll want to install the package into both the Source and Target. If you're not using Laravel, you will want to generate an RSA256 Public/Private Key Pair. Configuring the Factory ----------------------- [](#configuring-the-factory) If you are using Laravel, the Service Provider will automatically register a factory that uses a config file that publishes to `config/signed_urls` to store keys, and uses the Redis facade. `app('Twogether\URLSigner')` will return an instance of this. If you are configuring manually, then you need to create a Factory. ``` new Twogether\LaravelURLSigner\SignedUrlFactory( string $appName, CacheBroker $cacheBroker, KeyProvider $keyProvider = null ) ``` App Name is simply a short string identifying this application. Avoid using spaces, and keep it simple. The *Target* will use this to verify that requests from this source are unique, so you should not duplicate app\_names and use them with the same target. The CacheBroker is used to validate one-time *nonce* codes to prevent replay attacks. It expects to use Redis for this, and a PredisCacheBroker class is available for you to use by passing in an instance of `Predis\Client`. If you are not using Redis, or if you do not use Predis, then you can check this class to see what it does and implement your own by implementing the interface in `Contracts\CacheBroker`. Lastly the KeyProvider is optional. If you do not choose to use it then you will have to explicitly set the key every time you sign or validate a URL. We have provided an array implementation that you can configure: ``` new Twogether\LaravelURLSigner\KeyProviders\ArrayKeyProvider([ 'default' => [ 'public' => '', // Public key string 'private' => '', // Private key string ] ]); ``` You do not need to specify both public and private keys if you do not need them. A *Target* application that only receives requests and does not make them does not need a private key for example. And vice versa. If you want to sign or validate URLs with multiple services, you can add additional `keyName => [pair]` entries to this array. Signing ------- [](#signing) Now when you want to make a request from the Source, generate your target URL, and pass it through: `$factory->sign(string $url, string $keyName = 'default')` This will return your signed URL, or throw exceptions if your configuration is off. You can also call `make` which returns a `SignedUrl` object that supports additional fluent configuration if you want to specify additional options. e.g: ``` $factory->make('https://example.com') ->withKey(EXPLICIT PRIVATE KEY HERE) ->withExpiry(time()+300) // 5 minute expiry ->get() // returns the URL as a string ``` Here we can explicitly set the private key if we did not configure a provider. We can also specify that this URL will be valid for 5 minutes (default is 2). Validating ---------- [](#validating) `$factory->validate($url,string $keyName = 'default', string $publicKey = '')` will validate the signed URL and return true if it passes. You can either specify a keyName for your KeyProvider to fetch the public key, or pass the key as a string if you prefer. If it fails, it will throw an InvalidSignedUrl exception which has one method: `errors(): array`An array of validation errors, keyed by field to work with a Laravel Form Request. You may prefer to use Middleware. Note that the list of errors is not exhaustive, if something's wrong it will error immediately and only include the last error unless everything was missing. Get started with Laravel ------------------------ [](#get-started-with-laravel) To get started quickly, publish the config file and then set up a public or private key in `keys.default` in `config/signed_urls`. Now just add: `Twogether\LaravelURLSigner\Middleware\SignedURL:class` to a Middleware stack. The middleware also supports a keyName if you want to set up your routes. Alias the middleware in your kernel to `signed_urls`and then specify something like `signed_urls:reporting` to use the public key assigned to 'reporting' in your config. --- #### Note on keys [](#note-on-keys) Your public and private keys can either be a one line string, or the proper 64-character per-line versions with -----BEGIN----- and -----END-----. The library will handle either. ### Health Score 44 — FairBetter than 90% of packages Maintenance46 Moderate activity, may be stable Popularity30 Limited adoption so far Community14 Small or concentrated contributor base Maturity70 Established project with proven stability Bus Factor1 Top contributor holds 83.3% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~115 days Recently: every ~132 days Total 17 Last Release 415d ago Major Versions 1.0 → 2.02020-04-30 PHP version history (4 changes)1.0PHP ^7.1 2.1PHP ^7.1|^8.0 2.4PHP ^8.1 2.4.1PHP ^7.1|^8.1 ### Community Maintainers ![](https://www.gravatar.com/avatar/c309728d0e50bc4dfbc0dc31065ec1a2f244cce90ded1b742c9a67d07a2bebed?d=identicon)[actinity](/maintainers/actinity) --- Top Contributors [![Actinity](https://avatars.githubusercontent.com/u/1878605?v=4)](https://github.com/Actinity "Actinity (10 commits)")[![petermolnar3](https://avatars.githubusercontent.com/u/25197499?v=4)](https://github.com/petermolnar3 "petermolnar3 (1 commits)")[![ToineOtto](https://avatars.githubusercontent.com/u/149824026?v=4)](https://github.com/ToineOtto "ToineOtto (1 commits)") ### Embed Badge ![Health badge](/badges/twogether-laravel-url-signer/health.svg) ``` [![Health](https://phpackages.com/badges/twogether-laravel-url-signer/health.svg)](https://phpackages.com/packages/twogether-laravel-url-signer) ``` ### Alternatives [shlinkio/shlink A self-hosted and PHP-based URL shortener application with CLI and REST interfaces 5.1k5.2k](/packages/shlinkio-shlink)[malico/laravel-nanoid 4687.3k](/packages/malico-laravel-nanoid)[malios/php-to-ascii-table A PHP library to generate plain text tables. 29145.0k6](/packages/malios-php-to-ascii-table)[riipandi/laravel-optikey Use UUID, Ulid, or nanoid as optional or primary key in Laravel. 429.3k](/packages/riipandi-laravel-optikey) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)