PHPackages                             vercodea/auth-core - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. vercodea/auth-core

ActiveLibrary[Authentication & Authorization](/categories/authentication)

vercodea/auth-core
==================

Enterprise-grade authentication system with rate limiting (IP + user), VPN/proxy detection, pipeline access locking, CSRF protection, secure session management, OTP verification, magic link recovery, password strength validation, common/reserved password blocklists, and SQL injection prevention.

v1.0.0(1mo ago)21MITHTMLPHP ^7.4 || ^8.0

Since Jun 15Pushed 1mo agoCompare

[ Source](https://github.com/Vercodea/auth-core)[ Packagist](https://packagist.org/packages/vercodea/auth-core)[ RSS](/packages/vercodea-auth-core/feed)WikiDiscussions main Synced 2w ago

READMEChangelogDependencies (2)Versions (2)Used By (0)

Vercodea Auth Core
==================

[](#vercodea-auth-core)

> 🔐 Enterprise-grade PHP authentication system with advanced security features, rate limiting, OTP verification, and magic link recovery.
>
> ⚡ **100% Plug and Play** - Install → Configure → Initialize → Done. Everything is automated.

[![PHP Version](https://camo.githubusercontent.com/5d6f35116dcf1a8f07ddca65383a805470578c32ebb90cc97ddf250db6c08747/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d253345253344253230372e342d3737374242343f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://www.php.net)[![License](https://camo.githubusercontent.com/5caa455d8debc46fb23abbadb45a733a937f3910a73fc875c2f7820468e1bb54/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d677265656e)](LICENSE)[![Composer](https://camo.githubusercontent.com/2fbdbe423ac1ce73c694c9d81a73b3c9255e61c564e62219f38291257ade821d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5061636b61676973742d766572636f646561253246617574682d2d636f72652d626c7565)](https://packagist.org)[![Build Status](https://camo.githubusercontent.com/5b63f43aa1b7e4eb04322b3e27b56ae58cef2bfe9e13019b2c222a61fa4ba692/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4275696c642d50617373696e672d627269676874677265656e)](https://github.com)[![Security Scanning](https://camo.githubusercontent.com/0239b99fa1c7734349c9b9d33b1058e8896cfddaf9a0985a2417a3ec14a73a40/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f53656375726974792d4163746976652d726564)](https://github.com)

---

📋 Table of Contents
-------------------

[](#-table-of-contents)

- [Features](#-features)
- [Requirements](#-requirements)
- [Installation](#-installation) - **4 simple steps, fully automated**
- [Configuration](#-configuration)
- [Quick Start](#-quick-start)
- [API Reference](#-api-reference)
- [Security Features](#-security-features)
- [Activity Logging](#-activity-logging)
- [Database Schema](#-database-schema)
- [Best Practices](#-best-practices)
- [Troubleshooting](#-troubleshooting)
- [License](#-license)
- **[Support this project](docs/SPONSORSHIP.md)**

---

✨ Features
----------

[](#-features)

- 🔒 **bcrypt Password Hashing** - Industry-standard password encryption with PASSWORD\_DEFAULT algorithm
- 🛡️ **Dual-Layer Rate Limiting** - IP-based and user-based throttling to prevent brute force attacks
- 🌐 **VPN/Proxy Detection** - Real-time detection via ProxyCheck.io API with automatic blocking
- 📧 **OTP Verification** - 6-digit time-limited one-time passwords via email (Resend API)
- 🔑 **Magic Link Recovery** - Secure password recovery with unique tokens and expiration
- 🍪 **Secure Session Management** - Redis-backed sessions with CSRF protection and HttpOnly cookies
- ✅ **Comprehensive Input Validation** - Email, username, password, and OTP format validation
- 🚫 **Common Password Blocklist** - 94,500+ weak passwords prevented (+ reserved password list)
- 📝 **Activity Logging** - Audit trail for all authentication events with timestamps and user info
- 🔐 **SQL Injection Prevention** - 100% prepared statements via PDO
- 🚪 **Pipeline Access Control** - File-level security to prevent unauthorized direct execution
- 📬 **HTML Email Templates** - Beautiful, responsive email notifications for OTP, recovery, and account lockouts
- 🔔 **Account Lockout Notifications** - Automatic email alerts when suspicious activity detected
- 🌍 **Multi-Environment Support** - Development and production configurations

---

📦 Requirements
--------------

[](#-requirements)

ComponentVersionPurpose**PHP**7.4+ or 8.0+Core runtime**MySQL**5.7+User and session data storage**Redis**5.0+Session, OTP, and rate limit caching**PHP Extensions**`pdo`, `redis`, `curl`, `openssl`, `json`Required PHP modules**Composer**1.9+Dependency manager### PHP Extensions Verification

[](#php-extensions-verification)

```
php -m | grep -E "pdo|redis|curl|openssl|json"
```

---

🚀 Installation
--------------

[](#-installation)

**Plug and Play Setup** - Everything is automated. No manual SQL commands or database setup needed!

### Step 1: Install via Composer

[](#step-1-install-via-composer)

```
composer require vercodea/auth-core
```

### Step 2: Configure Environment

[](#step-2-configure-environment)

```
cp vendor/vercodea/auth-core/.env.example .env
```

Edit `.env` and fill in your credentials:

```
# Database
MYSQL_HOST=127.0.0.1
MYSQL_PORT=3306
MYSQL_USERNAME=root
MYSQL_PASSWORD=your_password
MYSQL_DBNAME=auth_system

# Redis
REDIS_HOST=127.0.0.1
REDIS_PORT=6379

# Email (Resend API)
OTP_API_KEY=your_resend_api_key
SEND_OTP_URL=https://api.resend.com/emails
DOMAIN=yourdomain.com

# Other settings as needed
```

**All environment variables have secure defaults.** See [Configuration](#-configuration) for complete list.

### Step 3: Initialize Database (One-time)

[](#step-3-initialize-database-one-time)

```

```

**That's it!** All required tables are created automatically. No manual SQL commands needed.

### Step 4: Start Using Authentication

[](#step-4-start-using-authentication)

```