Laravel Myinfo Sg Laravel Package

Product Decisions This Supports

• Market entry into Singapore / Singpass-dependent onboarding. If the roadmap includes SG users, MyInfo is the default rail for verified identity data (name, NRIC, address, income, employment) with user-consented retrieval. This package is the cheapest way to answer "can we do Singpass + MyInfo in our existing Laravel stack?" in a spike rather than a quarter-long build.
• Build vs. buy on identity. The decision is not "adopt package vs. nothing" — it's "wrap a community library vs. build the OIDC/JWE plumbing in-house vs. contract a regional identity vendor." This package makes the wrap option concrete and costable (days, not weeks), which sharpens the comparison.
• Onboarding funnel and drop-off. MyInfo collapses multi-step KYC forms into a consent screen. Use it to size a funnel hypothesis: fewer fields, higher completion, lower manual-review cost. Instrument consent-screen abandonment as the success metric, not just integration success.
• Risk-tiered KYC policy. MyInfo data is government-sourced and typically treated as higher assurance than self-declared input. That supports decisions like: skip document upload for MyInfo-verified users, auto-approve certain tiers, keep manual review for non-Singpass paths.
• Consent and data-minimization architecture. MyInfo is scoped and purpose-bound: you request specific attributes and must justify them during government onboarding. That forces a product decision on which fields you actually need (e.g., income only if credit-affecting), which is good PDPA hygiene and reduces downstream retention obligations.
• Roadmap sequencing. Use it to sequence: (1) Singpass login only, (2) MyInfo attribute retrieval, (3) re-consent / data refresh for recurring flows, (4) MyInfo Business for corporate KYC if the segment exists.

When to Consider This Package

Adopt (or at minimum spike) it when all of these hold:

• The stack is Laravel/PHP and you have no appetite to hand-roll OIDC + PKCE + JWKS signature verification + JWE decryption.
• You already have, or are actively pursuing, Singpass/MyInfo app registration with the relevant Singapore government body. This is the real gate — the library is the easy 10%. If you have no registered app, no client credentials, and no sandbox access, the package buys you nothing yet.
• Your use case is a web or server-side redirect flow, not native mobile SDKs (which want the Singpass mobile SDKs).
• The scope is attribute retrieval with consent, not full MyInfo Business, not continuous data sync, not delegated third-party data sharing at scale.
• You have a reviewer who can read the source. With ~16 stars, this is a single-maintainer, low-adoption dependency. Treat it as a well-structured reference implementation you can vendor and patch, not a vendor-supported SDK.

Look elsewhere / do not adopt when:

• Compliance-critical production identity with no internal PHP/security capacity to audit the token and decryption paths. Prefer building on a maintained OAuth2/OIDC library with an internal wrapper, or engage a Singapore-based integration partner.
• You need SLA, indemnity, or security disclosure processes. A 16-star package provides none of these.
• The package's supported MyInfo API version lags the one your government onboarding mandates. Verify against current Singpass/MyInfo specs before committing.
• You are not on Laravel, or you are on a version outside the package's tested matrix.
• You need MyInfo Business, Sign with Singpass, or delegated consent flows not covered by the package surface.

Due-diligence checklist before committing: PKCE enforced; JWKS cached with rotation handling; ID token signature and claims (iss, aud, exp, nonce) validated; MyInfo JWE decryption implemented with correct key management; no secrets or PII in logs; consent/state persistence; sandbox-to-production config parity; last-commit recency and open-issue responsiveness.

How to Pitch It (Stakeholders)

For executives (one paragraph): Singapore requires Singpass for trusted digital identity, and MyInfo lets users share government-verified personal data with us instead of typing it in. This open-source Laravel package implements that handshake, so we can validate the Singapore onboarding experience in roughly one to two engineering weeks instead of four to six, at near-zero license cost. It is a small, community-maintained project (16 GitHub stars), so we would treat it as accelerant, not foundation: we vendor the code, review the security-sensitive paths, and own the maintenance. The larger dependencies are non-technical — government app registration, attribute justification, and PDPA-aligned consent and retention design — and should be started in parallel, since they gate launch regardless of which code path we choose. Recommendation: fund a time-boxed spike now to de-risk the roadmap decision; defer the production build-vs-buy call until the spike returns, and do not position the package itself as the long-term platform bet.

For engineering (short): Use it as a reference/accelerator for the Singpass OIDC redirect flow and MyInfo person-data decryption in Laravel. Expect to fork or vendor; assume you own security review of token validation, JWKS rotation, JWE decryption, and PII logging. Budget for key management and separate sandbox/production credentials. Deliverables from the spike: working end-to-end consent → attribute retrieval in sandbox, a written gap list versus the current MyInfo spec, and an estimate for an internally maintained wrapper.