Weave Code
Sdk Laravel Package
twofas/sdk
PHP SDK for integrating 2FAS two-factor authentication into your applications. A lightweight client with straightforward configuration and clean, framework-friendly APIs for adding an extra layer of account security to Laravel and other PHP projects.
SDK for 2fas.com API
Frequently asked questions about Sdk
- Is twofas/sdk a Laravel package or a plain PHP SDK?
- It is a framework-agnostic PHP HTTP client for the 2FAS API. There is no service provider, facade, publishable config, or package auto-discovery, so all Laravel wiring is yours to write. The practical approach is to bind it in AppServiceProvider behind a domain-owned interface and keep SDK types in a single adapter namespace.
- How do I install and configure twofas/sdk in a Laravel app?
- Run composer require twofas/sdk, then place your 2FAS API credentials in config/services.php under a twofas key sourced from env or a secrets manager. Resolve the client through the container rather than constructing it inline with hardcoded keys. Keep the SDK behind an adapter so controllers, jobs, and guards never touch its DTOs or HTTP semantics directly.
- Does twofas/sdk support Laravel 10 and Laravel 11?
- It runs on PHP 8.x with Guzzle and therefore works under Laravel 10 and 11. The caveat is that it duplicates Laravel's HTTP client, retry, and middleware facilities instead of using them. You can either wrap it thinly and accept the duplicate transport or fork the transport layer onto Illuminate\Support\Facades\Http to inherit your existing timeout, retry, and observability conventions.
- Can twofas/sdk replace pragmarx/google2fa or Fortify for 2FA on my own login?
- No. twofas/sdk is an API client for the 2fas.com service, not a TOTP or HOTP verification library. If the requirement is simply two-factor authentication on your own application login, use Laravel Fortify, pragmarx/google2fa, or your identity provider. Letting the package name create ambiguity in a planning document is an easy failure mode to avoid.
- Is the 2FAS API publicly documented and versioned?
- There is no evidence of a versioned, documented, third-party-facing contract; the API appears to back 2FAS's own mobile and extension clients. That makes it a de facto private API with no deprecation policy, so any upstream change becomes your incident. Treat contract risk as high and get ownership sign-off before writing tickets.
- How do I test twofas/sdk in a Laravel test suite?
- The SDK uses a PSR-compatible HTTP layer, so you can inject a PSR-18 client backed by a mock handler instead of hitting the live API. Prefer faking at your own adapter interface boundary so tests assert on your domain contract rather than vendor DTOs. Never call the real 2FAS API in automated tests.
- What happens to login if the 2FAS API has an outage?
- If you invoke the SDK synchronously on the authentication path, a vendor outage becomes a login outage. Availability risk is high here, so design timeouts, circuit breaking, and a degraded path before shipping. Keep in mind that a vendor SDK inside auth is high blast radius and belongs in design review, not a sprint.
- Can twofas/sdk be used to store or decrypt users' 2FA secrets on our server?
- The non-negotiable rule is that your systems never receive plaintext shared secrets. Vault material crossing your boundary to a consumer SaaS also triggers DPA, sub-processor disclosure, and residency review. If a proposed feature requires server-side decryption, that is a scope decision to decline, not an engineering problem to optimize.
- Who maintains twofas/sdk and is it safe for production use?
- It has a single maintainer, zero stars, zero dependents, and no tagged releases or changelog. There is no field validation to inherit, no failure taxonomy, and no one to call during an incident. Its Guzzle and PSR-18 constraints may also collide with Laravel's HTTP client, so vendor or fork it and pin the version deliberately.
- How should I structure a twofas/sdk integration in a Laravel codebase?
- Place it as an infrastructure adapter behind a domain-owned interface such as TwoFactorVendorClient, bound in AppServiceProvider. Confine SDK types to one namespace so nothing about its DTOs or HTTP semantics reaches controllers, jobs, or auth guards. Before any ticket is written, confirm in design review whether the integration touches the authentication path at all.
Weaver
How can I help you explore Laravel packages today?