- How do I install tightenco/solana-php-sdk in a Laravel application?
- Install it with composer require tightenco/solana-php-sdk. The library is framework-agnostic, so in Laravel you typically bind SolanaRpcClient as a singleton in a service provider and inject it where needed. Plan for PHP 8.x, ext-sodium for ed25519 keypairs, and a PSR-18 or Guzzle HTTP client. There is no Node.js toolchain required.
- Does tightenco/solana-php-sdk support Laravel 10, 11, and 12?
- The SDK is framework-agnostic rather than a Laravel package with version constraints, so Laravel 10, 11, or 12 should work when the PHP version and required extensions are compatible. The provided evaluation does not list official Laravel version bounds, so confirm PHP and Laravel support before committing. Treat Composer platform requirements and CI results as your compatibility gate.
- Is tightenco/solana-php-sdk a Laravel package with a service provider?
- No. It is a Composer library, not a full Laravel package with a service provider. You wire it into Laravel yourself, usually by binding the RPC client as a singleton and externalizing endpoint, commitment, and auth-header configuration. That thin integration is intentional but means Laravel-specific conveniences are your responsibility.
- How do I configure the Solana RPC endpoint and commitment in Laravel?
- Put the Solana RPC endpoint, commitment level, and any auth headers in Laravel config and bind a configured SolanaRpcClient as a singleton. The evaluation flags per-call commitment configurability as something to verify rather than assuming it is built in. Externalizing these values keeps devnet, testnet, and mainnet settings out of code. Custom headers on call() can carry provider credentials.
- Can I use Helius, QuickNode, or another authenticated Solana RPC provider?
- Yes. Version 0.3.2 added custom headers on SolanaRpcClient::call(), which unblocks authenticated providers such as Helius, QuickNode, Triton, or an internal egress proxy. Configure the required headers in your Laravel config instead of forking the SDK. This turns production-grade RPC access into an infrastructure and vendor-budget decision.
- Does this SDK manage private keys or handle wallet custody?
- The SDK provides keypair and transaction-signing primitives, but it does not manage keys or provide custody. The evaluation is explicit that hot keys in .env are acceptable for a devnet spike and unacceptable for a production treasury; custody is a separate epic. Whether signing can be delegated to KMS or HSM instead of raw private keys in-process is an open question to resolve before treasury-adjacent work.
- Can I do partial signing, co-signing, or multisig with this SDK?
- The 0.3.2 signer fix clarifies that all signers must be supplied at once, so partial signing, co-signing, multisig, and approval workflows are constrained. Scope any roadmap item involving those patterns with that constraint visible now. If you need richer multi-party approval, plan for additional application design or different tooling.
- How should I test Solana transactions in CI with this PHP SDK?
- Use a controlled solana-test-validator harness in CI rather than relying only on devnet or mainnet smoke tests. The evaluation warns that expired blockhash, wrong commitment, fork or rollback, fee-payer semantics, and duplicate submission can become silent on-chain failures rather than exceptions. The SDK does not document a test-validator harness in the provided material, so treat that setup as your responsibility.
- Is tightenco/solana-php-sdk production-ready, and what are the main risks?
- Treat it as pre-1.0: v0.3.x means SemVer is not a stability contract, and minor bumps can break. The evaluation also cites weak adoption signals, zero dependents, a low composite screening score, and high maintainer concentration, even though Tighten is a credible PHP consultancy. Domain correctness and custody are separate risks; add validator testing and do not present custody as included.
- When should I avoid this SDK and use an alternative for Solana in Laravel?
- Avoid it for typed Anchor program composition, CPI-heavy flows, browser or mobile wallet signing, and hardened custody. It fits read and verify work and simple writes such as balance lookups, transaction status polling, ownership checks, and SOL or SPL transfers to known addresses. For the unsupported cases, use a Node or TypeScript Solana service, direct JSON-RPC through Guzzle for very simple reads, or specialized custody tooling.