Download the PHP package open-banking-io/client without Composer

open-banking-io (PHP)

Server-to-server client for open-banking.io. It authenticates with your API key and decrypts the zero-knowledge data envelopes locally with your exported private key — the service only ever returns ciphertext it cannot read.

Requires PHP 8.2+ with ext-openssl, ext-curl and ext-json (no runtime Composer dependencies).

Every request carries a User-Agent: open-banking-io/php/<version> header (Client::VERSION) and uses a 30s total / 10s connect timeout.

Or construct it explicitly:

Custom transport & timeouts

Both the constructor and Client::fromCredentials() take an optional array $options for proxy, custom CA / mTLS, and timeout control. curl_options (a map of CURLOPT_* => value) is applied last, so it wins over the SDK defaults; timeout / connect_timeout (seconds) override the 30s / 10s defaults:

API

• getAccounts(): Account[] — decrypts each account's envelope, display name and balances.
• getTransactions(string $accountId, array $opts = []): TransactionPage — $opts keys: from, to, limit, offset.
• getConnections(): Connection[]
• sync(string $accountId, array $opts = []): SyncResult — decrypts the account uid locally and posts it; throws if the account has no active session. $opts keys: fromDate (YYYY-MM-DD) to backfill from a given day instead of syncing incrementally.
• syncAll(): SyncAllResult — syncs every account whose session it can read; $result->unreadable lists the ones it could not, and isComplete() is the only proof the run covered everything.

Money/amount fields are exposed as decimal strings (exact; never a float). Models are final classes with readonly public properties under OpenBankingIO\Model.

A null amount is not zero

$transaction->amount and $balance->amount are ?string. null means the envelope could not be read, never that the transaction was for nothing — $transaction->isSealed() is true and $transaction->decryptError says why. Casting a null amount to a number books a zero-value entry that looks like real data, so branch on isSealed() before you read it:

The same holds for Account::isSealed(), which also reports a balance envelope it could not open.

Encryption

Envelopes use ECDH P-256 → HKDF-SHA256 → AES-256-GCM and are decrypted entirely in-process with ext-openssl. Full wire format and the other language clients: repo README · THREAT_MODEL.md.

Development

The tests read the shared fixtures/ directory, which the release pipeline vendors into tests/fixtures/ in the source mirror. The Packagist distribution archive omits tests/ entirely. The integration test spins up a local mock API using PHP's built-in server (php -S) as a subprocess.

Static analysis & formatting

Coverage

Coverage needs a driver. CI runs with pcov; locally you can also use Xdebug via XDEBUG_MODE=coverage. The <coverage> config emits Cobertura plus a text summary:

The report is written to coverage/cobertura.xml (gitignored). Because phpunit.xml enables a <coverage> report and failOnWarning, run the suite with a coverage driver present (pcov or XDEBUG_MODE=coverage); otherwise PHPUnit emits a "no coverage driver" warning.

Publishing (monorepo caveat)

PHP packages are distributed through Packagist, which auto-syncs from GitHub when a new tag is pushed. Packagist expects composer.json at a repository root, but this package lives in the php/ subdirectory of a monorepo. Two ways to publish it:

1. Subtree mirror (recommended): publish php/ to a dedicated mirror repo, e.g. git subtree split --prefix=php -b php-release && git push <mirror> php-release:main, and register that mirror on Packagist.
2. VCS config pointing at the path: some Packagist setups can be configured to read a package from a subdirectory — this is not the default and may require a custom/Private Packagist config.

This is intentionally not solved here — the publish-php.yml workflow validates the manifest and runs the tests, then optionally pings Packagist's update API when the PACKAGIST_USERNAME/PACKAGIST_API_TOKEN secrets are present.

MIT licensed.