Download the PHP package chuckbe/ponto-connect-laravel-sdk without Composer

On this page you can find all versions of the php package chuckbe/ponto-connect-laravel-sdk. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of chuckbe/ponto-connect-laravel-sdk

Informations about the package ponto-connect-laravel-sdk

Ponto Connect Laravel SDK

A Laravel SDK for the Ponto Connect API v2 by Isabel Group (Ibanity). Built on Saloon PHP with a fluent, resource-based interface: OAuth with PKCE, accounts, transactions, synchronizations, reauthorization, organization endpoints, sandbox test data and webhook signature verification.

Payment initiation endpoints (payments, bulk payments, payment requests and their activation requests) are not implemented yet.

Requirements

Installation

Publish the configuration file:

Configuration

Variable Description
PONTO_CONNECT_ENVIRONMENT sandbox or live. Selects the authorization host (https://sandbox-authorization.myponto.com or https://authorization.myponto.com). The API host is the same for both; Ponto routes your calls by certificate.
PONTO_CONNECT_CLIENT_ID / _CLIENT_SECRET OAuth client credentials from the security tab of the Ponto Connect product.
PONTO_CONNECT_APPLICATION_ID The application id, used as the expected aud of webhook signatures. Defaults to the client id.
PONTO_CONNECT_CERTIFICATE_PATH / _PRIVATE_KEY_PATH / _PRIVATE_KEY_PASSPHRASE The TLS certificate and private key for mutual TLS. Every API request uses them.
PONTO_CONNECT_CA_CHAIN_PATH Optional CA chain to verify the API server. Uses the system CA bundle when empty.
PONTO_CONNECT_SCOPES Scopes requested in the authorization URL, separated by spaces or commas. Default ai pi name offline_access. Drop pi if your application may not initiate payments.

Certificates

Keep the certificate and private key outside the repository and outside public/: for example ~/.config/chuck/ponto-sandbox/ locally, and a directory owned by the deploy user on the server, provisioned by your server recipes. Never commit them. Restrict the private key's permissions (chmod 600).

The sandbox and live environments use different certificates and client credentials. "Going live" means swapping these values, not changing code.

Usage

The manager never stores a token. Each call returns a fresh connector, so tokens for different organizations cannot leak into each other, for example in queue workers.

1. Connect with PKCE

Optionally, prefill the Ponto sign-up first with a client access token. Use the id within five minutes:

2. Exchange the code

$userInfo also exposes name, onboardingComplete, paymentsActivated, paymentsActivationRequested, paymentRequestsActivated, paymentRequestsActivationRequested, and, when the customer acts as a representative, representativeOrganizationId and representativeOrganizationName.

3. Refresh with rotation

Access tokens live 30 minutes. Refresh tokens are single-use: every refresh returns a new refresh token and invalidates the old one immediately.

4. Accounts and transactions (cursor pagination)

Lists return a Page with items, nextCursor (page[after]), previousCursor (page[before]) and limit. Pages accept ?int $limit = null (1 to 100, default 10), ?string $after and ?string $before.

Amounts are strings. Ponto sends amounts and balances as JSON numbers. They are converted to decimal strings with the shortest representation that matches the decoded number exactly, padded (never rounded) to at least two decimals: -85 becomes "-85.00", -99.29 stays "-99.29". Use bcmath or a money library, never floats. Dates are DateTimeImmutable in UTC.

5. Synchronizations (customer present only)

Ponto synchronizes in the background four times a day. You may trigger an extra synchronization only while the customer is actively using your application, and you must pass their real IP address. A new synchronization of the same account and subtype is refused within 30 minutes of the previous one.

6. Reauthorization

When an account's bank consent expires (authorizationExpirationExpectedAt, or a synchronization error like authorizationExpired):

7. Webhooks

The verifier accepts only RS512, picks the key by kid, checks aud (your application id), iss (https://api.ibanity.com) and digest (base64 SHA-512 of the raw body), and checks exp/iat with 30 seconds of leeway. WebhookEvent exposes id, type, eventType(), createdAt, attributes, count(), synchronizationSubtype(), accountId, organizationId, synchronizationId, paymentRequestId and jti.

8. Sandbox test transactions

Sandbox only, with a customer access token of a sandbox integration:

The transaction appears in transaction->list() after the next synchronization of that account.

Organization endpoints (client access token)

PontoConnect::api()->oauth->revoke($refreshToken) revokes with the refresh token instead.

Errors

Every 4xx/5xx response throws PontoConnect\Exceptions\PontoConnectException:

InvalidGrantException extends it for invalid_grant from the token endpoint.

Security

API reference

Resource Method Endpoint
oauth authorizationUrl(redirectUri, state, codeChallenge, ?scopes, ?language, ?onboardingDetailsId) {authorization host}/oauth2/auth (no API call)
oauth exchangeAuthorizationCode(code, redirectUri, codeVerifier) POST /ponto-connect/oauth2/token
oauth refresh(refreshToken) POST /ponto-connect/oauth2/token
oauth clientCredentials() POST /ponto-connect/oauth2/token
oauth revoke(refreshToken) POST /ponto-connect/oauth2/revoke
userInfo get() GET /ponto-connect/userinfo
onboardingDetails create(attributes, ?idempotencyKey) POST /ponto-connect/onboarding-details
financialInstitution list(?limit, ?after, ?before, filters), all(filters), get(id) GET /ponto-connect/financial-institutions[/{id}]
account list(...), all(), get(id), revoke(id) GET/DELETE /ponto-connect/accounts[/{id}]
transaction list(accountId, ...), all(accountId), get(accountId, id) GET /ponto-connect/accounts/{accountId}/transactions[/{id}]
transaction listUpdatedForSynchronization(synchronizationId, ...), allUpdatedForSynchronization(...) GET /ponto-connect/synchronizations/{id}/updated-transactions
pendingTransaction list, all, get, listUpdatedForSynchronization, allUpdatedForSynchronization .../pending-transactions, .../updated-pending-transactions
synchronization create(resourceId, subtype, customerIpAddress, resourceType = 'account', ?idempotencyKey), get(id) POST/GET /ponto-connect/synchronizations[/{id}]
reauthorizationRequest create(accountId, redirectUri, ?idempotencyKey) POST /ponto-connect/accounts/{accountId}/reauthorization-requests
integrationAccount list(...), all() GET /ponto-connect/integration-accounts
usage get(organizationId, month) GET /ponto-connect/organizations/{organizationId}/usage/{month}
integration delete(organizationId) DELETE /ponto-connect/organizations/{organizationId}/integration
sandbox listFinancialInstitutionAccounts, getFinancialInstitutionAccount GET /ponto-connect/sandbox/financial-institutions/{id}/financial-institution-accounts[/{id}]
sandbox listFinancialInstitutionTransactions, getFinancialInstitutionTransaction, createFinancialInstitutionTransaction, updateFinancialInstitutionTransaction GET/POST/PATCH .../financial-institution-accounts/{id}/financial-institution-transactions[/{id}]
webhook keys() GET /webhooks/keys

Architecture

Development

Unit tests use Orchestra Testbench and Saloon's MockClient, with fixtures copied from the example responses in the API reference (tests/Fixtures).

Sandbox smoke test

tests/Integration/SandboxSmokeTest.php calls the real sandbox: it requests a client-credentials token, lists financial institutions and fetches the webhook keys. When PONTO_CONNECT_TEST_REDIRECT_URI is set to a registered redirect URI, it also checks that the authorization server accepts the configured scopes. It is not part of the default suite and is skipped unless the PONTO_CONNECT_* variables are set:

It prints status codes only, never tokens or secrets.

Official documentation

License

MIT

All versions of ponto-connect-laravel-sdk with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
ext-json Version *
ext-openssl Version *
firebase/php-jwt Version ^6.11|^7.0
illuminate/support Version ^10.0|^11.0|^12.0|^13.0
saloonphp/laravel-plugin Version ^3.0
saloonphp/saloon Version ^3.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package chuckbe/ponto-connect-laravel-sdk contains the following files

Loading the files please wait ...