Weave Code
Client Php Laravel Package
corbado/client-php
Corbado client for PHP adds passwordless authentication to Laravel/PHP apps, supporting passkeys and email-based login flows through Corbado’s APIs. Integrate secure, phishing-resistant sign-in without managing passwords.
Add passkeys to your PHP application with the Corbado PHP SDK.
Frequently asked questions about Client Php
- How do I install corbado/client-php in a Laravel app?
- Install it with Composer using composer require corbado/client-php. It is a thin PHP HTTP client, not a Laravel package, so it does not register a service provider or publish config. You wrap it in your own service provider or adapter and configure Corbado credentials and API details yourself. Check Composer resolution against your Laravel and PHP versions before committing.
- Does corbado/client-php support Laravel 11 and Laravel 12?
- The package is not Laravel-native, so Laravel support depends on its PHP and HTTP dependency constraints rather than framework integration. Its archived status means there are no active maintenance or new Laravel compatibility guarantees. Run a throwaway Composer resolution against your actual composer.json for Laravel 11 or 12 and PHP 8.2+ before adoption. If it pins Guzzle or PSR-18 versions that collide with your stack, it can block upgrades.
- Is there a service provider, facade, or config file for Corbado in Laravel?
- No. corbado/client-php is a thin HTTP client and does not ship a Laravel ServiceProvider, facade, publishable config, or Blade or Inertia scaffolding. Integration requires writing your own binding, configuration, and wrapper around the SDK. Keep SDK calls behind an internal interface such as PasskeyProvider so controllers never call it directly.
- Why was corbado/client-php archived, and is it still safe to use?
- The repository is archived, which means it receives no active fixes, feature work, or CVE response. Passkey and WebAuthn handling is security-sensitive, so a frozen SDK carries ongoing liability if you adopt it. Ask Corbado for the officially supported PHP path today, and confirm whether the underlying API remains versioned and supported independently of this client.
- How do I add passkeys to Laravel without using a Laravel-native package?
- Treat Corbado as an external service and place it behind a single adapter implementation bound in a service provider you write. The adapter should own registration and login ceremony calls, while your Laravel app owns session and state correlation and feature flags. Keep password or email OTP available as a fallback and roll out passkeys as an optional secondary login first.
- What configuration is needed for passkey registration and login with Corbado?
- You must configure the relying-party ID and origin per environment, usually different for local, staging, and production. You also need to wire session and state correlation between the browser ceremony and your Laravel backend and choose an attestation policy. These requirements exist regardless of SDK and are usually more work than the SDK calls themselves.
- How should I test a Laravel integration with corbado/client-php?
- Because the SDK is a thin HTTP client, do not let tests depend on Corbado availability or real ceremonies. Define an internal PasskeyProvider interface, bind a fake or stub implementation in tests, and assert your controllers and flows call that interface correctly. Keep a small number of integration tests against a sandbox or recorded responses for ceremony wiring.
- What are alternatives to corbado/client-php for passkeys in PHP or Laravel?
- Consider web-auth/webauthn-lib for self-hosted WebAuthn verification if you want to own the credential flow and avoid a hosted login dependency. Also evaluate maintained first-party or community Laravel passkey packages and Corbado's current hosted redirect flow, if one exists. Compare maintenance, compliance, ceremony wiring effort, and exit or export options before choosing.
- Can corbado/client-php block a Laravel major upgrade?
- Yes. A dead package in composer.json can constrain PHP or HTTP dependency versions and prevent the whole app from moving to a new Laravel major. The likely conflicts are pinned Guzzle or PSR-18 versions or a PHP constraint that predates 8.2. Test resolution against your target Laravel version now, and avoid adopting it if it cannot resolve cleanly.
- What should I check before putting Corbado passkeys in production?
- Confirm the Corbado API is still supported, versioned, and covered by an SLA, with clear pricing and rate limits. Review data residency and DPA terms because credential metadata and user identifiers leave your infrastructure, and ask how to export credentials if you leave. Start with optional enrollment for a low-risk cohort behind a feature flag, keep fallback login methods, and never make passkeys the only factor on day one.
Weaver
How can I help you explore Laravel packages today?