Weave Code
Php Sdk Laravel Package
corbado/php-sdk
Official Corbado PHP SDK for adding passwordless authentication to PHP apps. Supports passkeys, email magic links, and session management with simple backend integration for secure, frictionless sign-in.
Add passkeys to your PHP application with the Corbado PHP SDK.
Frequently asked questions about Php Sdk
- How do I install the Corbado PHP SDK in a Laravel application?
- Install it with Composer using composer require corbado/php-sdk, then add your Corbado project ID and API credentials to your environment configuration. Because the SDK is a framework-agnostic client for Corbado's hosted API, you will need to bind the client in Laravel's service container and wire up any middleware or routing yourself. Keep the credentials in .env and out of version control, and confirm the package's Composer constraints install cleanly on your PHP version before going further.
- Does the Corbado PHP SDK support Laravel 11, Laravel 12, and modern PHP versions?
- The package is a plain PHP SDK rather than a Laravel package, so there are no official Laravel version constraints to rely on. Treat Laravel 10, 11, and 12 with PHP 8.1 through 8.4 as a test matrix you must verify yourself, checking the SDK's Guzzle and PSR dependency constraints along the way. Because the repository is archived, any incompatibility you hit becomes an internal fix rather than an upstream patch.
- Is the Corbado PHP SDK still maintained?
- The GitHub repository is archived, and even though the most recent release is dated 2025-03-24, archival means no further security responses, dependency bumps, or PHP and Laravel compatibility fixes. Before building on it, confirm directly with Corbado whether PHP is still an officially supported platform and what the API deprecation policy looks like. If you proceed, plan to vendor or fork the SDK and own its maintenance internally.
- Do I still need frontend JavaScript to use passkeys with this SDK?
- Yes. The SDK is a backend client for Corbado's API, so the WebAuthn ceremony itself happens in the browser through Corbado's web component or JavaScript SDK. Your Laravel backend then validates the resulting session or token using this SDK. Budget for enrollment, sign-in, and account recovery UI work in addition to the PHP-side integration.
- Can the Corbado PHP SDK replace Laravel's built-in authentication guards?
- Not directly. Corbado is a hosted authentication service and this package is a client wrapper, so it typically sits alongside Laravel's session and guard model as a second authentication path rather than replacing it. A practical pattern is wrapping it behind your own interface, such as a PasskeyProvider contract, so guards, controllers, and middleware never depend on SDK classes directly. Keep your existing password or SSO recovery flows available during and after rollout.
- What are good alternatives to corbado/php-sdk for passkeys in Laravel?
- For self-hosted, standards-based passkeys, look at web-auth/webauthn-lib or Laragear WebAuthn, which fit Laravel guards and Eloquent user models more naturally. If you prefer a managed provider, choose one with active PHP support, a published SLA, and a clear deprecation policy. This SDK is mainly a fit for teams already standardized on Corbado or deliberately buying a managed passkey service.
- How do I handle account recovery when a user loses their passkey?
- Corbado supports email magic links alongside passkeys, which is the usual fallback, but you still have to design and test the recovery flow inside your Laravel application. Decide which identifiers map to accounts, how re-enrollment works after a lost device, and how support staff verify identity before resetting anything. Ship a working fallback before you enable passkey-only sign-in for any cohort.
- Is it safe to use an archived SDK for production authentication?
- Authentication is security-critical, and an archived SDK will not receive CVE fixes or dependency updates, so the risk is high unless you fork and maintain it yourself. The MIT license permits that, but owning a passkey SDK is a specialized maintenance burden with real ongoing cost. Run a threat model covering session validation, secret storage, and PII in logs, and factor in an independent security review before going live.
- How should I test passkey authentication with the Corbado PHP SDK?
- Exercise the enroll, authenticate, and recover flows in a disposable Laravel app against non-production Corbado credentials before touching real users. WebAuthn requires a real browser with a platform authenticator, so pair browser-based end-to-end tests with a fake or mocked SDK client for fast unit tests. Avoid using --ignore-platform-reqs to force installation in CI, since that hides the dependency problems this package is most likely to have.
- What is the migration path if we decide to leave Corbado later?
- Corbado holds passkey credential metadata, so ask early about data export and how user identifiers map to standard WebAuthn credentials you could import into a self-hosted library. Pin the SDK version, keep it behind an internal adapter, and document the API contract so the rest of your codebase is not coupled to SDK classes or vendor endpoints. Without a contractual exit plan and a proven export path, do not adopt this package for a new build.
Weaver
How can I help you explore Laravel packages today?