Download the PHP package avsbhq/avsb without Composer

avsbhq/avsb: PHP SDK

Server-side PHP SDK for A vs B, the feature-flag and experimentation platform.

PHP 8.2 or later. One runtime dependency (psr/log). PSR-4 autoloading, a PSR-3 logger, an optional PSR-18 transport, plus Laravel and Symfony glue.

How it works: your application downloads one JSON datafile from a global CDN, caches it on disk, evaluates flags locally in microseconds, and posts exposures and conversions after the response. There is no proxy to run and no request to A vs B on the hot path.

1. Install

Optional integrations:

ext-curl is used when present; the SDK falls back to PHP streams when it is not, so nothing is required.

2. Quickstart

That is the whole setup. The constructor loads the datafile through a TTL cache in your system temp directory, so a warm process pays a file read and a cold one pays a single CDN round trip with a timeout.

Build the server once per request, in your container rather than per call: each instance holds the datafile and batches that request's events.

Recommended production shape: the agent

PHP processes are short-lived, which means every worker eventually refetches the datafile and every request flushes its own small batch. That is fine at modest traffic and it is what the quickstart above does.

At higher traffic, run the A vs B agent as a sidecar: one process holds the datafile, keeps it fresh over SSE, and buffers events for the whole host. Point PHP at the file it writes and construct from that:

fromDatafile never fetches: the SDK key comes from the datafile, and something else owns freshness.

3. SDK keys

An SDK key looks like sdk_production_ttqm0eaj4vth1krcb2xn: the prefix sdk_, your environment name, then a generated id. Copy the key for the environment you want from the A vs B dashboard, under Environments in the project sidebar.

The SDK checks the shape at construction. A pasted dashboard URL, a truncated copy, or an API token in this field logs an error naming the mistake, and the SDK carries on, so the problem is visible before the datafile request 404s.

SDK keys are public identifiers: they name an environment and grant read access to that environment's datafile, which is served from a CDN with no authentication. That is by design and safe in a browser. It is not an API credential: personal access tokens (avsb_pat_...) and service tokens (avsb_svc_...) are secrets and must never appear in client code.

4. Configuration

Everything optional lives in one typed object, and every field has a working default:

datafileTtlSeconds is the floor on how quickly a flag change reaches this process: a shorter TTL means fresher flags and more CDN reads.

Reusing your HTTP client

Your middleware, proxy settings, and instrumentation then apply to A vs B requests too. Psr18Transport accepts those objects structurally, so no PSR HTTP package becomes a dependency of this one. Timeouts come from the client you pass, because PSR-18 has no per-request timeout.

5. Context and identity

The first argument is the bucketing identity. Evaluating with an empty key buckets every caller identically and makes experiment data meaningless, so the SDK warns once per process and names the call to add.

When a rule sets hashAttribute to organization.key, everyone in the same organization gets the same variation regardless of their own user key. Audience conditions scoped to a kind read only that sub-context, and a condition naming a kind the context does not carry never matches.

6. Reading flags

$defaultValue is required on every call. It is what you get when the flag is missing, the SDK never loaded a datafile, or the flag is off, and it comes back unchanged with its type intact.

The getters do not coerce: $flag->value is whatever json_decode produced for that variation. If a flag's variations hold strings and you call getBoolFlag, the value is that string, not true. Read $flag->value for the value and $flag->isEnabled() for a gate.

Flag

All properties are readonly and public, so there are no getters to remember:

EvaluationSource is a backed enum, so $flag->source->value is the wire string and match ($flag->source) { ... } is exhaustive:

isEnabled() is true when the source is one of Rule, Holdout, Bandit, Sticky, DatafileOverride, or RuntimeOverride and the value is truthy. Truthy means what it means in JavaScript, because the reference engine is TypeScript and every SDK must answer identically: false, 0, "", and null are falsy, and everything else is truthy, including the string "0" and an empty array. A flag serving its default variation is never enabled, however truthy that default is.

exists() is false for NotFound and NotReady, and true for everything else. A disabled flag exists: the customer turned it off.

Was the datafile loaded?

Every failure is logged with the URL tried and a curl that reproduces it.

Decision log

Each entry carries the same fields as Flag plus contextSummary (kind and key only; attributes are never logged) and honours _meta.privateAttributes redaction.

7. Tracking events

$eventName is the metric key from your dashboard. An unknown key is stored, so a typo shows up as an empty metric rather than an error. $revenue is money in decimal major units, for revenue metrics; $value is the number for average-value metrics. Both are optional.

Exposures are automatic. Every ab_test, bandit, and holdout decision records one, so you do not call anything to make experiment results appear.

Queued events are sent once, after the response, from a shutdown function. Orders send immediately, because a purchase is the event you least want buffered in a process that might be killed. Call flushEvents() to send early, or pass events: false to switch all sending off.

8. Sticky bucketing

A sticky store keeps a user on the variation they first saw, even if traffic allocations change later.

Shipped stores: InMemoryStickyBucketService (one request, for tests and CLI scripts) and RedisStickyBucketService (predis or ext-redis). Any class implementing StickyBucketService works.

The store is read before the evaluator and written only after an ab_test rule match, storing the variation id. A targeted delivery is a rollout, not an assignment, so it is not stored. If a stored variation has since been deleted the lookup is a miss; if its rule is gone the stored value is still served, with a warning and no exposure, because the experiment it would be attributed to no longer exists. Pass onStickyOrphan to observe that case.

9. Bandits

bandit-typed rules dispatch through the bandit engine. With no model store supplied the SDK runs the algorithm's documented cold-start policy, which is deterministic for a given datafile and context, so a configured bandit never silently behaves as "no rules matched". Every bandit rule that cannot dispatch appends a reason naming why, visible in $flag->reasons.

10. Logging and failure

AvsbServer accepts any PSR-3 logger:

With no logger it writes warnings and errors to stderr in development and stays silent in production, detected from APP_ENV or SYMFONY_ENV. Pass a logger explicitly in production to keep the messages.

Evaluation never throws. A missing flag, an unexpected type, or an SDK with no datafile returns your $defaultValue with a source that says which of those it was.

11. Laravel

Register the service provider in config/app.php:

config/avsb.php:

AvsbServer is then resolvable from the container:

The route middleware binds an EvalContext built from the authenticated user (or the session id) onto the request:

12. Symfony

13. Testing

Build a datafile and construct from it: no network, no cache, no events.

InMemoryDatafileLoader::fromArray, fromJson, and fromFile all return a server with events and heartbeats switched off, so a suite never touches the network by accident.

Run the suite:

tests/ConformanceTest.php runs the shared cross-language corpus from packages/avsb-conformance (or the copy vendored into tests/vendor), asserting that this evaluator produces identical values, sources, and reason strings to the reference TypeScript engine. Missing fixtures fail the suite rather than being skipped.

14. OpenFeature

The provider maps targetingKey onto the context key; rule, holdout, and bandit onto TARGETING_MATCH; sticky onto CACHED; the two override sources onto STATIC; and a server with no datafile onto PROVIDER_NOT_READY.

15. Migrating from the LaunchDarkly PHP SDK

Differences that matter: getters are typed and require an explicit default, the return value is a Flag carrying the full decision trail rather than a bare value, and multi-context is a static factory instead of a builder.

LaunchDarkly pushes PHP to daemon mode because its SDK cannot hold a streaming connection. A vs B has the same constraint and the same answer, but the default path still works: the datafile is a cached CDN read, and the agent is the optimisation rather than the prerequisite.