Download the PHP package verifymyagecouk/verifymyage-oauth without Composer

VerifyMyAge PHP SDK

A PHP SDK for integrating with VerifyMyAge's verification service. This library provides easy-to-use methods for implementing age verification in your PHP applications.

Table of Contents

• Installation
• Features
• Usage
  • SDK Versions
  • Verification Methods
  • Webhook Notification Levels
  • Supported Countries
• OAuthV3 (Recommended)
  • Start a Verification
  • Get Verification Status
  • Manage Allowed Redirect URLs
• OAuthV2
• OAuthV1 / OAuth (Legacy)
• Development Mode
• Error Handling
• Security Considerations

Installation

Features

• API v3 support with direct HMAC authentication
• Multiple verification methods
• Support for various countries
• Sandbox environment for testing
• User data encryption

Usage

SDK Versions

Verification Methods

Webhook Notification Levels

Supported Countries

The SDK supports various countries including:

• Australia (Countries::AUSTRALIA)
• Brazil (Countries::BRAZIL)
• Spain (Countries::SPAIN)
• United Kingdom (Countries::UNITED_KINGDOM)
• France (Countries::FRANCE)
• Germany (Countries::GERMANY)
• United States (Countries::UNITED_STATES_OF_AMERICA)
• Indonesia (Countries::INDONESIA)
• Ireland (Countries::IRELAND)
• Italy (Countries::ITALY)
• Demo mode (Countries::DEMO)

OAuthV3 (Recommended)

OAuthV3 targets the /api/v3/verifications endpoints and uses HMAC authentication directly — there is no OAuth2 code-exchange step. After the user completes verification they are redirected to your redirect_url with a verification_id query parameter; use getVerification() to retrieve the result.

Start a Verification

Encrypting User Info Fields

Sensitive values in userInfo are expected by the API to be encrypted. How encryption is applied depends on the field:

• email is encrypted automatically. When you include email in userInfo, the SDK encrypts it for you before the verification is created. Pass it as a plain string — do not encrypt it yourself, or it will be double-encrypted and rejected.
• Other fields, such as phone, are NOT encrypted by the SDK. The SDK only encrypts the email field. If you need to send another field encrypted, you must encrypt it yourself before adding it to userInfo, using the same scheme the SDK applies to email.

Encrypting phone (and other fields) manually

The SDK encrypts email with AES-256-CFB, using a key derived from your API secret. To send phone encrypted, replicate that exact scheme:

• Key: the first 32 bytes of the raw (binary) SHA-256 hash of your API secret.
• IV: 16 random bytes, generated per value.
• Output: base64 of the IV concatenated with the ciphertext (base64(iv . ciphertext)).

Important: Only encrypt fields the SDK does not handle. Never pre-encrypt email — the SDK already encrypts it, and encrypting it twice will cause the verification to be rejected.

Get Verification Status

After the user completes verification they are redirected to your callback URL with ?verification_id=abc123. Use that ID to fetch the result:

Manage Allowed Redirect URLs

OAuthV2

OAuthV2 targets the /v2/auth/start endpoint. After verification the user is redirected with a code and verification_id; exchange the code for a token to retrieve user data.

OAuthV1 / OAuth (Legacy)

The legacy OAuth class uses the OAuth2 authorization-code redirect flow:

Development Mode

All SDK versions support sandbox mode. Use it during development to avoid affecting production data:

Sandbox endpoint: https://oauth.sandbox.verifymyage.com
Production endpoint: https://oauth.verifymyage.com

Error Handling

The SDK throws \Exception for invalid inputs and API errors. API errors include the HTTP status code in the exception message as JSON:

Security Considerations

• Always use HTTPS for redirect URLs and webhook endpoints
• Keep your API credentials secure and out of version control
• Validate the verification_id received in callbacks before using it
• Use webhook signature verification where available