Weave Code
Sapient Laravel Package
paragonie/sapient
Sapient is a PHP cryptography library from Paragon Initiative Enterprises offering simple, misuse-resistant APIs for authenticated symmetric encryption, public-key encryption, and digital signatures, built on libsodium with versioned ciphertexts and key-management helpers.
Secure API Toolkit
Frequently asked questions about Sapient
- How do I install paragonie/sapient in a Laravel app?
- Install it with Composer using composer require paragonie/sapient. It requires ext-sodium, which is bundled with PHP 7.2 and later and is present in modern Laravel runtimes, so there is no exotic system dependency. There is no Laravel service provider or config stub, so you will create your own thin wrapper or service class for keyring construction and crypto operations.
- Does paragonie/sapient have a Laravel service provider or facade?
- No. Sapient is a framework-agnostic PHP library, not a Laravel package, and it ships no facade, middleware, config stub, or HTTP transport opinion. In a Laravel estate the recommended shape is a small application wrapper: a service class, a Guzzle HandlerStack middleware for outbound requests, and an inbound request-guard middleware. That keeps cryptographic calls out of controllers and inside your service layer.
- Which PHP and Laravel versions work with paragonie/sapient?
- Sapient relies on libsodium via ext-sodium, which is bundled with PHP 7.2 and later, so it runs on every modern Laravel runtime. Because the library is framework-agnostic, your Laravel version is not the constraint; the PHP runtime and ext-sodium availability are. Check your deployment images for the sodium extension before committing to an integration.
- How is Sapient different from JWT or JOSE?
- Sapient is deliberately not JWT or JOSE. It is a sibling concept to PASETO from the same authors, offering simple, misuse-resistant APIs built on libsodium with versioned ciphertexts and keyring helpers. That design avoids much of the algorithm-agility and header-handling complexity developers must reason about with JOSE.
- Can I use Sapient to encrypt requests between Laravel microservices?
- Yes. Sapient provides authenticated symmetric encryption, X25519 public-key encryption, sealed messages, signatures, and signed-plus-sealed combinations for machine-to-machine traffic. In Laravel you would wire a Guzzle HandlerStack middleware into your outbound HTTP client and an inbound middleware to verify or decrypt requests. Sign the exact request bytes rather than re-serialized JSON, and keep the envelope semantics in your own application code.
- How does key rotation work with Sapient keyrings?
- Sapient keyring abstractions embed a key identifier in a protocol header or footer, so a receiver can select the correct key during rotation. You still need to design the rotation cadence and overlap window before the first production message is sent. Key loss is unrecoverable, so custody and rotation planning belong in your architecture, not in a controller.
- Does Sapient handle replay protection, message expiry, or clock skew?
- No. Replay protection, expiry, clock skew, idempotency, and error-response shapes are your responsibility at the application layer. Sapient protects the payload and can give you signatures, but it does not enforce freshness or define a request lifecycle. You must sign exact request bytes and add your own nonce, timestamp, or cache-based replay checks.
- Can Go, mobile, or other non-PHP services interoperate with Sapient?
- Only if they implement or port the Sapient protocol, because it is a PHP library and not a standardized cross-language format like JOSE. If your API boundary includes Go services, vendor appliances, or mobile clients, that becomes a hard blocker or a bespoke porting project. This interoperability question is the largest architectural decision when evaluating Sapient for a mixed-language estate.
- Is paragonie/sapient a replacement for TLS or user authentication?
- No. Sapient provides message-level cryptography that protects payloads end-to-end and can provide non-repudiation, but it is not TLS, not authentication of users, and not an authorization model. It complements transport security rather than replacing it. Define your threat model first, such as a compromised TLS terminator, a curious message broker, or an untrusted intermediary, before adopting it.
- Is paragonie/sapient maintained, and what are the alternatives?
- ParagonIE is highly credible on applied cryptography, but it is a small vendor and Sapient is a niche package with roughly 309 stars, so bus-factor risk is real. The MIT license, compact auditable codebase, and libsodium foundation mitigate that because you can fork or audit it. Alternatives include PASETO from the same authors, mTLS plus OAuth2 client credentials, or an existing JWT/JOSE investment. Choose based on whether you genuinely need message-level crypto and whether all counterparties are PHP.
Weaver
How can I help you explore Laravel packages today?