Weave Code
Php Laravel Package
authy/php
PHP SDK for Twilio Authy two-factor authentication. Register and verify users, send and check one-time tokens, and manage phone-based 2FA through a simple, PSR-compatible client with Laravel-friendly integration.
PHP client for Authy
Frequently asked questions about Php
- What is authy/php used for in a Laravel application?
- authy/php is a lightweight PHP client for the Twilio Authy API that adds two-factor authentication to PHP applications. In Laravel, you would use it to register users by email and phone number, send verification codes by SMS or voice, and verify TOTP or Authy app tokens. It is not a complete Laravel MFA package; it is a server-side REST client you wrap in your own application service. Keep it behind an app-owned MfaProvider interface rather than calling it directly from controllers.
- Does authy/php include a Laravel service provider or facade?
- No. authy/php is not Laravel-native and does not add a service provider, facade, config publishing, or package auto-discovery. You must wire the client manually in a service provider or container binding. A practical approach is to bind it as a singleton and expose only an application-owned MfaProvider interface. This keeps Authy-specific types out of controllers and domain logic.
- How do I install authy/php in a Laravel project?
- Install it with Composer, for example composer require authy/php:4.0.0-rc2 if you are evaluating PHP 8 support. Pin the exact version because 4.0.0-rc2 is a pre-release and it is not a stable semver commitment. Confirm that ext-curl and ext-json are available and that your Guzzle and PSR-7 constraints resolve. Avoid loosening minimum-stability globally just to allow the release candidate.
- How should I configure authy/php API keys and HTTP timeouts in Laravel?
- Store the Authy API key in your secret management system and read it through Laravel configuration, not hard-coded constants. Set explicit HTTP timeouts on the underlying Guzzle client and map Authy exceptions to application-level errors. Redact API keys, phone numbers, and verification tokens from logs. Enforce these settings at the service-provider boundary so controllers cannot bypass them.
- Does authy/php support PHP 8 and Laravel 10 or 11?
- The 4.0.0-rc2 release adds PHP 8 support, which removes the previous blocker for Laravel 9, 10, and 11 targets. However, it is still a pre-release, and the package itself does not claim Laravel-native support. Validate PHP 8.1, 8.2, and 8.3 along with Guzzle 7 and PSR-7/PSR-18 constraints in a spike before committing. Confirm the PHP minors and Laravel versions exercised in CI rather than assuming compatibility.
- What Authy flows can authy/php handle?
- It covers common Authy operations such as registering and managing users by email and phone number. It can send verification codes by SMS or voice and verify TOTP and Authy app tokens. That makes it suitable for a server-side 2FA adapter behind your own MFA interface. Confirm any additional flows you need, such as push approvals, against the 4.0.0-rc2 API before adopting it.
- How do I test an authy/php integration without calling Authy?
- Wrap authy/php behind an application-owned MfaProvider interface and fake or mock that interface in your Laravel feature tests. Keep a small adapter test suite that verifies how Authy exceptions are mapped and how timeouts are handled without requiring live SMS or voice delivery. Use test credentials only in isolated environments and never log verification tokens. If you test the client directly, inject a mocked HTTP handler rather than making real API calls.
- Is authy/php suitable for production two-factor authentication?
- It carries high technical risk because it sits in a critical security path and has had uncertain maintenance. The 4.0.0-rc2 release fixes the PHP 8 blocker but introduces pre-release risk and unknown breaking changes from 3.x. If you must use it, pin the exact RC, vendor or fork it if you need patches, review the release provenance, and complete a security review. For greenfield projects, evaluate Twilio Verify or a Laravel-native TOTP approach first.
- What are the alternatives to authy/php for Laravel 2FA?
- Twilio Verify is the natural migration target if you want Twilio-managed verification, and a Laravel-native TOTP approach such as a Fortify-compatible MFA flow avoids a third-party REST client. Both are better first choices for greenfield Laravel applications than an unmaintained or intermittently maintained Authy client. If you migrate, expect re-enrollment because existing secrets and push registrations are unlikely to be exportable. Keep the migration on your roadmap even if 4.0.0-rc2 is used as a temporary bridge.
- Is authy/php actively maintained, and what changed in 4.0.0-rc2?
- The 4.0.0-rc2 release suggests renewed activity, but it does not prove active maintenance or a security-response commitment. Review the diff from 3.x carefully, especially client construction, exception types, and response models, because breaking changes may affect your adapter. Verify that the release comes from the canonical repository and publisher and that the tag is signed. Treat any later stable 4.0.0 release as a separate upgrade requiring its own review.
Weaver
How can I help you explore Laravel packages today?