PHP SDK (auris/sdk)

auris/sdk provides an OAuth Authorization Code flow with PKCE, token exchange, refresh and user validation. It uses PHP built-ins rather than external runtime packages.

Requirements

The package requires PHP 7.4 or later and the extensions listed in its Composer manifest. The positional arguments below also work on PHP 7.4; named arguments require PHP 8. Start a PHP session before using the default SessionTokenStore.

composer require auris/sdk

Register a public application and its exact callback URL in Auris. Use HTTPS in production. The current token-exchange implementation does not send the configured clientSecret; do not treat that field as proof of confidential-client authentication.

Configuration

Create a shared bootstrap.php. Supply the three environment variables from your application configuration; no real credentials are included here.

<?php
declare(strict_types=1);
require __DIR__ . '/vendor/autoload.php';
 
use Auris\AurisClient;
use Auris\AurisConfig;
 
session_start();
$domain = getenv('AURIS_DOMAIN');
$clientId = getenv('AURIS_CLIENT_ID');
$redirectUri = getenv('AURIS_REDIRECT_URI');
if (!$domain || !$clientId || !$redirectUri) {
    throw new RuntimeException('Auris application configuration is required');
}
// AURIS_DOMAIN includes https:// and has no trailing slash.
$auris = new AurisClient(new AurisConfig($domain, $clientId, $redirectUri));

Use secure, HTTP-only session cookies with an appropriate SameSite policy in your deployment. Do not expose bearer or refresh tokens to browser scripts or logs.

Login

<?php
// login.php
require __DIR__ . '/bootstrap.php';
header('Location: ' . $auris->getLoginUrl());
exit;

getLoginUrl() generates PKCE and state values, stores them through the configured TokenStore, and returns the hosted authorization URL. Start one login attempt per session at a time.

Callback

<?php
// callback.php
require __DIR__ . '/bootstrap.php';
 
try {
    $tokens = $auris->handleCallback($_GET['code'] ?? '', $_GET['state'] ?? '');
    if ($tokens->accessToken === '') {
        throw new RuntimeException('No access token returned');
    }
    $user = $auris->getUser($tokens->accessToken);
    session_regenerate_id(true);
    $_SESSION['auris_access_token'] = $tokens->accessToken;
    $_SESSION['auris_refresh_token'] = $tokens->refreshToken;
    header('Location: /account.php');
    exit;
} catch (Throwable $error) {
    http_response_code(400);
    echo 'Sign-in failed. Start a new login attempt.';
}

handleCallback(code, state) checks the stored state and exchanges the authorization code. It returns a TokenResult; your application must store the returned tokens. The SDK’s default store holds PKCE/state values, not an automatically managed authenticated session.

Validate the user

<?php
// account.php
require __DIR__ . '/bootstrap.php';
$token = $_SESSION['auris_access_token'] ?? '';
if ($token === '' || $auris->isTokenExpired($token)) {
    header('Location: /login.php');
    exit;
}
try {
    $user = $auris->getUser($token);
    echo htmlspecialchars($user->firstName ?? $user->userId, ENT_QUOTES, 'UTF-8');
} catch (Throwable $error) {
    unset($_SESSION['auris_access_token'], $_SESSION['auris_refresh_token']);
    http_response_code(401);
    echo 'Your session could not be validated. Sign in again.';
}

getUser(accessToken) calls Auris token validation. isTokenExpired(accessToken) only decodes the expiry claim; it does not verify a signature and is not an authorization decision. Check the user’s tenant and action/resource permissions before returning protected business data.

Token management

TokenResult contains accessToken, nullable refreshToken, tokenType, expiresIn and nullable scope. It does not provide an idToken or getUser() method. AurisClient does not provide isAuthenticated() or getAccessToken(); those are responsibilities of your session layer.

When refreshing, replace the stored access token and any rotated refresh token atomically. Submit logout through a CSRF-protected application POST, call logout($token), then clear the local session. Do not implement a state-changing logout link as an unprotected GET.

Test before rollout

Test a valid callback, wrong state, expired or reused authorization code, a missing browser session, refresh failure and a rejected validation response. Confirm the exact API contract of the SDK version you install. This guide describes the repository implementation; the examples were reviewed against its method signatures and do not establish a live tenant acceptance test.

For a standalone API verification exercise, use the Node.js signed-token example. To review your callback, session and tenant boundaries, request an Auris integration demo .