Weave Code
Singpass Login Laravel Package
accredifysg/singpass-login
Laravel package for SingPass Login, MyInfo, and CorpPass with a FAPI 2.0–style flow: PAR, DPoP, PKCE, and private-key JWT client assertions. Shared services handle discovery, token exchange, and JWE/JWS processing, with thin per-provider controllers.
A Laravel Package for integrating Singpass Login, Myinfo, and Corppass
Frequently asked questions about Singpass Login
- How do I install the accredifysg/singpass-login package in Laravel?
- Install it with Composer using composer require accredifysg/singpass-login. Then publish the package configuration with the config tag through Laravel's vendor:publish command. After publishing, populate the required SingPass, MyInfo, and CorpPass environment values and review config/ndi.php.
- What Laravel and PHP versions does accredifysg/singpass-login support?
- The package requires Laravel 9+ and PHP 8.1+. It is built around Laravel's HTTP client, Auth facade, event system, routing, and configuration system. Confirm your exact Laravel version through Composer dependency resolution before upgrading an existing application.
- How do I configure SingPass Login, MyInfo, and CorpPass credentials in Laravel?
- Publish the package config and populate .env values such as SINGPASS_CLIENT_ID and MYINFO_REDIRECT_URI. Configure JWKS and DPoP settings in config/ndi.php, and set provider-specific scopes, routes, cache keys, and redirect URIs. The package uses a ProviderConfig DTO so each provider's settings stay externalized rather than hard-coded.
- What is the FAPI 2.0-style flow used by this SingPass package?
- The package implements a FAPI 2.0-style authorization flow with Pushed Authorization Requests, DPoP on PAR, token, and UserInfo calls, PKCE, and private-key JWT client assertions. Your OpenID Provider discovery metadata must expose a pushed_authorization_request_endpoint, which the package validates when caching discovery. Shared services handle discovery, PAR, DPoP, PKCE, token exchange, and JWE/JWS processing.
- How should I store NDI_PRIVATE_JWKS securely in production?
- Store NDI_PRIVATE_JWKS in a secrets manager such as AWS KMS or HashiCorp Vault, or in encrypted environment storage with tightly restricted access. Do not commit the private key or expose it in logs. Misconfiguration can lead to token forgery or revocation issues, so key handling should be treated as a production-critical control.
- How do I handle session state and CSRF for SingPass login in a distributed Laravel app?
- The package uses Laravel's session for the OAuth state parameter and CSRF protection, and its routes are registered under the web middleware. For distributed or load-balanced deployments, use a persistent shared session backend such as Redis or Memcached instead of the default file driver. Ensure session cookies are secure and that session storage is reliable across all application nodes.
- How can I test SingPass, MyInfo, and CorpPass integration without hitting real NDI endpoints?
- Use Laravel HTTP fakes to mock discovery, the PAR endpoint, token exchange, and UserInfo responses, and provide fake discovery metadata that exposes pushed_authorization_request_endpoint. Validate that DPoP proofs and JWT client assertions are generated with the expected structure, and assert that the correct provider-specific events fire after callbacks. The shared FAPI services and thin provider controllers make these boundaries testable without live SingPass credentials.
- Why is my MyInfo scope validation failing or silently returning missing data?
- The package relies on unverified JWT parsing for scope checks in the MyInfo flow, so malformed tokens may cause silent failures or incorrect scope assumptions. Verify that requested scopes such as nationality or dob are whitelisted in config/myinfo.php. Check the returned token payload and enable NDI_LOGS_ENABLED when debugging, because logging is disabled by default.
- How do I map CorpPass entity and actor to Laravel users?
- CorpPass uses a hierarchical identity model with an entity representing the company and an actor representing the user. Configure the required scopes, including user.identity, and map the returned entity and actor to your internal models in post-login event listeners. Missing or misconfigured scopes can break actor resolution, so validate the CorpPass payload before creating or updating application users.
- What are alternatives to accredifysg/singpass-login for SingPass, MyInfo, and CorpPass in Laravel?
- Alternatives include implementing the OAuth2/OIDC flow yourself or using generic OIDC and OAuth2 libraries, but you would still need to add PAR, DPoP, PKCE, JWT client assertions, and provider-specific CorpPass and MyInfo handling. This package provides those FAPI 2.0-style mechanics plus Laravel-native Auth, HTTP, event, routing, and configuration integration. When comparing options, account for maintenance, secure key management, and migration away from deprecated helpers such as SingPassUser::getNric().
Weaver
How can I help you explore Laravel packages today?