Download the PHP package cipi/sdk without Composer

cipi/sdk

PHP client for the Cipi panel API. One Sanctum token is enough to manage apps, deploys, domains, databases, and the server from PHP, Laravel, Symfony, or any other framework.

The package talks only to the REST API (/api/*). It does not open SSH and it does not shell out to cipi on the machine where your code runs.

Documentation: cipi.sh/docs/php-sdk.

Requirements

• PHP 8.2+
• ext-curl and ext-json
• A Cipi server with cipi/api installed and a token from cipi api token create

Laravel 11, 12, and 13 can use the service provider and facade. They are optional.

Install

Create a token on the server and grant only the abilities this application needs (apps-view, deploy-manage, and so on). The panel returns 403 when the token is missing an ability.

Quick start

https://api.example.com and https://api.example.com/api are both accepted. Plain http:// is rejected unless you pass allow_http: true for a local panel.

Responses are the JSON body as an associative array. Writes that the panel queues return job_id and status: pending. wait() polls GET /api/jobs/{id} until the job is completed or failed.

Laravel

The service provider is discovered automatically.

Or inject the client:

One container binding talks to one server. For several servers, call Cipi::connect() with each endpoint and token.

Other frameworks

Symfony, Slim, WordPress, or a script: construct the client yourself and pass it through your container. There is no framework-specific bundle to install.

What you can call

A few examples:

node_build (Laravel apps only) is the asset build Cipi runs inside every deploy, before the release goes live. It starts with npm, npx, yarn, pnpm, bun, or node, allows && and ;, refuses pipes, redirects, backticks, and $( ), and is at most 200 characters. The panel validates it and answers 422 (ValidationException) on a bad command or on a custom or Node app (Node apps take build). Needs cipi/api 1.34.0+ and Cipi CLI 5.6.0+.

The same versions report whether the app's deploy key can read its repository. The app-create job result, and the app-edit result when the repository or branch changed, carry repository_access; app-create also carries build. The check never fails the job, so look at it after wait():

status is ok, nobranch, or denied; branch, error, and hint are optional. On older servers, and on apps without a repository, the key is absent.

limits()->update() is an async job. Pass disk_limit_gb: null to clear the soft limit. DNS-01 and the disk limit need Cipi CLI 5.5.0+. disk() needs CLI 5.5.2 (older hosts return 503). ssl()->setDnsAccount() is synchronous, so the Cloudflare token is not queued, and the panel never returns it.

Installing host packages, changing monitor thresholds, and mutating Cloudflare Zero Trust stay on the server CLI. The API exposes those as read-only, and so does this SDK. Disk usage is read-only too; the per-app limit is limits().

Errors

Failed HTTP responses throw Cipi\Sdk\Exception\CipiException (or a subclass):

wait() throws JobFailedException when the job finishes with failed, and TimeoutException if it is still running when the timeout elapses (default 300 seconds).

Security

• HTTPS and certificate verification are on by default. Redirects are not followed, so the Bearer token cannot be sent to another host.
• The token is sent only in the Authorization header. A token that contains whitespace or control characters is rejected, so it cannot inject a second header.
• The token is removed from exception messages, response arrays, and var_dump / print_r output.
• Reads (GET) may retry 429 and 503 when Retry-After is at most 10 seconds. Writes are never retried.
• Response bodies are capped (16 MiB by default).

Store CIPI_TOKEN in the environment of the machine that runs PHP. Do not commit it, and do not log the client. Create a separate token per application, with the smallest ability set that works.

Tests

License

MIT. Copyright (c) 2026 Andrea Pollastri.