PHPackages                             xident-io/php-sdk - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. xident-io/php-sdk

ActiveLibrary[Authentication & Authorization](/categories/authentication)

xident-io/php-sdk
=================

PHP SDK for Xident age and identity verification

v1.0.0(3mo ago)01MITPHPPHP ^8.1

Since Apr 9Pushed 2w agoCompare

[ Source](https://github.com/xident-io/php-sdk)[ Packagist](https://packagist.org/packages/xident-io/php-sdk)[ Docs](https://docs.xident.io/sdks/php)[ RSS](/packages/xident-io-php-sdk/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (1)Versions (2)Used By (0)

Xident PHP SDK
==============

[](#xident-php-sdk)

Server-side PHP SDK for [Xident](https://xident.io) age and identity verification. Zero external dependencies. Works with Laravel, Symfony, WordPress, and any PHP 8.1+ application.

Requirements
------------

[](#requirements)

- PHP 8.1+
- cURL extension (bundled with PHP)
- JSON extension (bundled with PHP)

Installation
------------

[](#installation)

```
composer require xident-io/php-sdk
```

Without Composer: `require_once '/path/to/xident-php/autoload.php';`

Quick Start
-----------

[](#quick-start)

```
use Xident\SDK\Client;

$xident = new Client(apiKey: $_ENV['XIDENT_SECRET_KEY']);

// 1. Create init token (your backend)
$session = $xident->verification()->init([
    'callback_url' => 'https://yoursite.com/verify-callback',
    'min_age'      => 18,
]);
// Redirect user to $session->verifyUrl

// 2. After user returns, verify server-side (NEVER trust URL params)
$result = $xident->verification()->getResult($token);

if ($result->isVerified()) {
    echo $result->ageBracket(); // 18
}
```

How It Works
------------

[](#how-it-works)

1. Your backend calls `POST /verify/v1/init` with your secret key
2. SDK returns an init token (`xit_`) + verify URL. You redirect the user there.
3. User completes verification on `verify.xident.io` (liveness + age check)
4. Widget redirects the browser back to your `callback_url` with query params: `status` (`success`, `failed`, or `cancelled` — British spelling), `token`(the **result** token, `xtk_` prefixed — a different token from the `xit_`init token), and `user_id` (if you supplied one).
5. Your backend calls `GET /verify/v1/result/{token}` with the `xtk_` result token to get the result
6. You make the authorization decision based on the verified result

API Reference
-------------

[](#api-reference)

### Client

[](#client)

```
$xident = new \Xident\SDK\Client(
    apiKey:     'sk_live_xxx',            // Required
    baseUrl:    'https://api.xident.io',  // Optional (default)
    timeout:    30,                        // Optional seconds
    maxRetries: 3,                         // Optional (retries on 5xx)
);
```

### verification()->init(params): InitResult

[](#verification-initparams-initresult)

ParameterTypeRequiredDescription`callback_url`stringYesHTTPS URL for callback (localhost OK for dev)`min_age`intYes\*1–99. **Required** for age verification — omitting it (or `0`) returns HTTP 400. Optional (0–99) only when `purpose` is `id_verification`.`success_url`stringNoRedirect on success`failed_url`stringNoRedirect on failure`user_id`stringNoYour internal user ID (echoed back on the callback)`theme`stringNo`light`, `dark`, or `system`. Unknown values coerce to `system`.`locale`stringNo`en`, `es`, `fr`, `de`, `pt`, `ar`, `zh`, `ja`, `hi`, `nl`. Unknown → `en`.`metadata`stringNoOpaque string echoed back to you (e.g. a JSON blob or plan ID). Xident stores it verbatim and never parses it.`purpose`stringNo`age_verification` (default) or `id_verification`.Returns: `$result->token` (init token, `xit_` prefixed), `$result->verifyUrl`

### verification()->getResult(token): SessionResult

[](#verification-getresulttoken-sessionresult)

Pass the **result** token (`xtk_`) from the callback — not the `xit_` init token.

Properties: `$result->token` (the `xtk_` result token), `$result->status`, `$result->ageResult`, `$result->countryCode`, `$result->regime`, `$result->remainingAttempts`, `$result->createdAt`, `$result->expiresAt`.

Helpers: `isVerified()`, `isFailed()`, `isPending()`, `isTerminal()`, `ageBracket()`, `method()`

### webhooks()->constructEvent(payload, signature, secret): array

[](#webhooks-constructeventpayload-signature-secret-array)

Verify HMAC-SHA256 webhook signature and parse event.

```
$event = $xident->webhooks()->constructEvent(
    payload:   file_get_contents('php://input'),
    signature: $_SERVER['HTTP_X_XIDENT_SIGNATURE'],
    secret:    'whsec_xxx',
);
// $event['type'], $event['data']
```

Error Handling
--------------

[](#error-handling)

```
use Xident\SDK\Exceptions\XidentException;
use Xident\SDK\Exceptions\AuthenticationException;
use Xident\SDK\Exceptions\NotFoundException;

try {
    $result = $xident->verification()->getResult($token);
} catch (AuthenticationException $e) {
    // 401 - Invalid API key
} catch (NotFoundException $e) {
    // 404 - Session not found
} catch (XidentException $e) {
    echo $e->getErrorCode();   // API error code
    echo $e->getRequestId();   // For support tickets
    echo $e->getHttpStatus();  // HTTP status
}
```

Exception hierarchy: `AuthenticationException` (401), `ValidationException` (400), `NotFoundException` (404), `RateLimitException` (429), `ServerException` (5xx), `NetworkException` (cURL errors).

Retry Behavior
--------------

[](#retry-behavior)

Automatic retry with exponential backoff (1s, 2s, 4s) on 5xx and network errors only. Never retries 4xx.

Laravel Example
---------------

[](#laravel-example)

```
class VerificationController extends Controller
{
    public function start(Request $request)
    {
        $xident = new \Xident\SDK\Client(apiKey: config('services.xident.secret_key'));
        $session = $xident->verification()->init([
            'callback_url' => route('verify.callback'),
            'min_age' => 18,
            'user_id' => (string) $request->user()->id,
        ]);
        return redirect($session->verifyUrl);
    }

    public function callback(Request $request)
    {
        $xident = new \Xident\SDK\Client(apiKey: config('services.xident.secret_key'));
        $result = $xident->verification()->getResult($request->input('token'));
        if ($result->isVerified()) {
            $request->user()->update(['age_verified' => true]);
            return redirect()->route('dashboard');
        }
        return redirect()->route('verify.failed');
    }
}
```

See `examples/` for Symfony, WordPress, and webhook examples.

Security
--------

[](#security)

- **Secret key**: Never expose `sk_*` in frontend code
- **TLS 1.2+**: Enforced on all API calls
- **Webhooks**: Always verify signatures (`hash_equals` for timing-attack resistance)
- **Verification tokens**: Always re-verify server-side. Never trust URL params alone.
- **SSRF**: HTTP client does not follow redirects

Testing
-------

[](#testing)

```
composer test              # 85 tests, 172 assertions
composer test:coverage     # With HTML coverage report
```

Mock the client in your tests:

```
$transport = new \Xident\SDK\Tests\Helpers\MockTransport();
$transport->queueSuccess(['token' => 'xit_test', 'verify_url' => 'https://verify.xident.io?t=xit_test']);
$client = new \Xident\SDK\Client('sk_test_xxx', transport: $transport);
```

Links
-----

[](#links)

- [Try it live](https://demo.xident.io)
- [Documentation](https://docs.xident.io/sdks/php)
- [API Reference](https://docs.xident.io/api-reference)
- [JavaScript SDK](https://docs.xident.io/sdks/javascript) (client-side counterpart)
- [Dashboard](https://dashboard.xident.io) (get your API key)

License
-------

[](#license)

MIT

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance89

Actively maintained with recent releases

Popularity1

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

106d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/c52a0ea2a11e9895de9fd3cafa31e78eea938fb2038e4e0080e63b12ef538eee?d=identicon)[farmani](/maintainers/farmani)

---

Top Contributors

[![farmani](https://avatars.githubusercontent.com/u/1329580?v=4)](https://github.com/farmani "farmani (14 commits)")

---

Tags

phpsdkidentityage-verificationxident

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/xident-io-php-sdk/health.svg)

```
[![Health](https://phpackages.com/badges/xident-io-php-sdk/health.svg)](https://phpackages.com/packages/xident-io-php-sdk)
```

###  Alternatives

[ory/hydra-sdk

ORY Hydra SDK

17.4k47.3k](/packages/ory-hydra-sdk)[bocharsky-bw/vkontakte-php-sdk

Vkontakte PHP SDK

3359.6k1](/packages/bocharsky-bw-vkontakte-php-sdk)[kinde-oss/kinde-auth-php

Kinde PHP SDK for authentication

2287.5k3](/packages/kinde-oss-kinde-auth-php)[surfoo/geocaching-php-sdk

Geocaching PHP SDK

143.5k1](/packages/surfoo-geocaching-php-sdk)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)