Download the PHP package gabrielecorio/fiscozen-wrapper without Composer

fiscozen-wrapper

An unofficial PHP wrapper for the Fiscozen web application API.

Disclaimer: This is an unofficial, reverse-engineered client. It is not affiliated with, endorsed by, or supported by Fiscozen. Use at your own risk. The underlying API may change at any time without notice.

Requirements

• PHP >= 8.1
• Composer

Installation

Authentication flow

Fiscozen uses a two-factor authentication flow:

1. Submit credentials → the API sends an OTP to your registered phone number.
2. Submit the OTP → session cookies are persisted to disk for reuse.

The wrapper exposes two approaches depending on your use case.

Two-step (web application)

Credentials and OTP arrive in separate HTTP requests, so each step is called independently. Session cookies are written to disk between the two calls.

Single-step (CLI / scripts)

Provide an OTP callback that blocks until the user types the code. The library handles the full flow synchronously. If a valid session already exists on disk it is reused and the callback is never called.

Checking and destroying a session

Available API methods

The read-only endpoints are grouped by domain. They reuse the authenticated session and CSRF handling provided by AuthManager.

Only GET endpoints observed in captured application traffic are included. No write endpoint is exposed.

Invoices

Counterparts

The optional choices and counterpartType filters are strings because the captured traffic does not establish a stable set of allowed enum values.

Payment methods

Dashboard

Pagination

Paginated methods return a PaginatedResponse with the fields observed in the API response:

Pagination parameters must be greater than or equal to 1. Unknown filters are deliberately not accepted.

Local read-only scripts

Each script performs a single action and prints JSON to standard output; none of them save API responses automatically. Log in once with login.php, then run any read script against the session it created:

The read scripts never trigger a login themselves — if no valid session is found they print an error asking you to run login.php first, keeping each script to one action.

API responses can contain personal or fiscal data. Review terminal and process access before running these commands, and do not redirect output to a file unless that file is protected and excluded from version control.

Environment variables

All scripts in examples/ read their configuration from the environment instead of hardcoded values:

To avoid placing credentials in shell history, enter them interactively:

Session cookies are stored in the git-ignored sessions/ directory by default.

User profile

Session persistence

Each user's session is stored in a single JSON file named after the SHA-256 hash of their email address. The directory is created automatically if it does not exist.

You can override the directory:

Exceptions

Full example

The examples/ directory contains one script per action, each reading its configuration from the environment variables described above:

• examples/login.php — checks whether a valid session already exists, and otherwise runs the two-step login flow with terminal OTP input.
• examples/read_user_info.php — calls getUserMe() and prints the result.
• examples/read_dashboard.php, examples/read_invoices.php, examples/read_counterparts.php, examples/read_payment_methods.php — one script per read-only domain endpoint.

Running tests

Project structure

License

This project is released under the MIT License.