Download the PHP package pps-protocol/laravel-pps without Composer

Laravel PPS

Laravel integration for the PulseProof Sentinel Protocol (PPS)

Introduction

laravel-pps is the official Laravel integration package for the PulseProof Sentinel Protocol, abbreviated PPS.

This package provides:

• Laravel service provider
• Publishable configuration
• API routes
• HTTP controller
• Facade
• Artisan commands
• Database migrations
• Storage backend integration
• Silent duress handling support
• Transaction signing support

The core protocol implementation lives in the framework-agnostic package:

This package, pps-protocol/laravel-pps, depends on pps-protocol/pps-php and only adds Laravel-specific integration.

What is PPS?

PulseProof Sentinel Protocol, or PPS, is an experimental authentication protocol based on time-bound asymmetric proofs.

Instead of shared-secret TOTP codes:

PPS uses signed asymmetric proofs:

The server stores only public keys.

PPS is designed to complement, not replace, WebAuthn/FIDO2.

WebAuthn remains preferred for browser-based passkey authentication.

PPS targets operational gaps such as:

• offline or semi-offline authentication
• legacy OTP-style input flows
• QR-code and deep-link authentication
• constrained hardware terminals
• point-of-sale and IoT devices
• transaction signing with human-visible amount confirmation
• silent duress signaling
• offline multi-device threshold approval

Important Links

Requirements

The core package pps-protocol/pps-php will be installed automatically.

Installation

Install via Composer:

Laravel package discovery should automatically register:

and the facade:

If package discovery is disabled, register manually in config/app.php:

Publish Configuration and Migrations

Run the install command:

This publishes:

Then run migrations if you are using the PDO storage driver:

Configuration

The main configuration file is:

You can also configure PPS using environment variables.

Relying Party Identifier

The rp_id identifies your service.

Examples:

For local development:

Storage Drivers

PPS needs storage for:

• device public keys
• key sequence counters
• threshold groups
• nonces

Supported drivers:

Memory

For testing only:

File

Good for development or single-process apps:

Default path:

PDO

Recommended for production:

Then run:

Redis

For high-performance distributed deployments:

Routes

By default, this package registers the following routes:

You can customize the prefix:

Or disable default routes:

Health Check

Example response:

Basic Authentication Flow

1. Get Challenge

Example response:

2. Register Device

Device registration requires a registration_token.

The registration_token is generated by a PPS client using the core package:

Then send it to Laravel:

Example response:

3. Authenticate

The client creates a Pulse Token:

Then send it to Laravel:

Example response:

Facade Usage

Verify a Pulse:

Transaction Signing

Create a transaction challenge:

Example response:

The client should bind the transaction hash and amount to the Pulse:

Then verify:

The Trust Code includes the AmountMark:

The last two digits match the transaction amount modulo 100.

Silent Duress

PPS supports silent duress signaling.

If a user authenticates under coercion, the client can sign with a hidden duress key.

The server detects this internally:

Important:

The HTTP response for a duress authentication must be indistinguishable from a normal successful authentication.

Do not return:

Instead, return:

Then internally:

• restrict account capabilities
• block high-value operations
• delay settlement
• trigger a silent alert
• preserve audit logs

Threshold Mode

PPS supports offline multi-device threshold approval.

The core package implements n-of-m Ed25519 multisignature.

This Laravel package can verify threshold Pulses through the same verification engine provided by pps-protocol/pps-php.

Threshold group management may be implemented in your application or added in future versions of this package.

Artisan Commands

Install PPS Resources

Publishes:

Generate Key Pair

Example output:

Warning:

Never commit secret keys to source control.

Testing

Run package tests:

Package Architecture

This package does not reimplement the protocol.

It only provides Laravel integration around the core package.

Security

This package is experimental.

It has not been independently audited.

Do not use it in production without:

• cryptographic review
• security audit
• interoperability testing
• operational risk assessment

See SECURITY.md.

Changelog

See CHANGELOG.md.

License

Apache License 2.0

See LICENSE.