Download the PHP package hamada-emam-tech/nafath without Composer

On this page you can find all versions of the php package hamada-emam-tech/nafath. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of hamada-emam-tech/nafath

Informations about the package nafath

Nafath for PHP

Latest Version

Identity verification through Nafath, Saudi Arabia's national digital identity service — both the web redirect and the app-push flow, in any PHP project.

The Nafath API is not difficult. What makes it expensive is that several of its behaviours are surprising and fail silently — a callback that matches nothing, a 404 on a path the specification lists, a 401 that means "still waiting" rather than "failed". This package was extracted from a production integration and every one of those is already handled.

Docs: how verification actually flows · getting credentials from Nafath · CodeIgniter (each: wiring + persistence, single- and multi-tenant)

Quick start

Web flow — the person goes to Nafath and comes back

App-push flow — the person never leaves your site

What this package already knows

Each row cost real days on a production integration.

Trap How it presents Handled by
The state is not in the JSON body — it is inside the url query string You can never complete a verification yourself AuthorizeUrl parses it out
hashedState = base64(sha256(state)) — they are different values Callbacks match nothing, silently AuthorizeUrl::matches()
JWK lives at /api/v1/mfa/jwk, not /api/v2/oidc/jwk 404 No Mapping Rule matched, looks like their outage one resolved path
The token field is token, not jwt Breaks on your first successful verification client reads token
401-033-024 means not approved yet Integration reports itself broken while working VerificationResult::pending() — a result, never a throw
Environments differ only by path prefix; production has none Production traffic silently reaches a test system Environment owns the prefix
Each environment needs its own APP-ID and APP-KEY 403 that looks like a bad key credentials bound to an environment
Only one active transaction per identity Second attempt refused, user locked out typed error that says to check the app
The transaction lives 200s, but a real person's journey is longer Expires mid-approval, blamed on Nafath documented; set your own window

There is deliberately no option to skip signature verification. Everything downstream — a national ID, a verified name, the decision to let somebody into an account — is exactly as trustworthy as that signature.

Verification is not only registration

The same person may need to prove who they are when logging in from a new device, before a payout, or when changing a phone number. Purpose carries that through to your audit trail, and picks the right Nafath service key:

Environments

One host; the environment is the path prefix.

Environment Base URL
Sandbox https://rabet-nafath.api.elm.sa/nafath-sandbox
Staging https://rabet-nafath.api.elm.sa/stg
Production https://rabet-nafath.api.elm.sa — no prefix

/prd, /prod and /production do not exist and answer 404.

Each environment is a separate Rabet registration with its own credentials. A staging pair returns 403 against production, indistinguishable from a bad key.

Requirements

Before you go live

Nafath requires your callback to be hosted inside Saudi Arabia. This is a regulatory requirement, not a technical one — hosting it elsewhere is the kind of thing that gets an integration shut down.

License

MIT © Hamada Emam

All versions of nafath with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
ext-json Version *
psr/http-client Version ^1.0
psr/http-factory Version ^1.0
psr/log Version ^2.0 || ^3.0
psr/simple-cache Version ^2.0 || ^3.0
firebase/php-jwt Version ^6.10
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package hamada-emam-tech/nafath contains the following files

Loading the files please wait ...