Download the PHP package zhylon/zhylonid-service without Composer
On this page you can find all versions of the php package zhylon/zhylonid-service. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Informations about the package zhylonid-service
ZhylonID Service
Server-to-server Laravel client for the ZhylonID identity API.
Lets any Zhylon-ecosystem product check whether a ZhylonID account already exists for an
email address, and sync local users against ZhylonID via the client_credentials grant.
This package only talks to ZhylonID's internal API (service-to-service). It is not an
OAuth2 login/SSO integration for end users — for "Login with ZhylonID" use
zhylon/zhylon-auth instead.
Installation
Laravel's package auto-discovery registers the service provider and ZhylonId facade
automatically. Publish the config file:
Configuration
Set the following in your app's .env — never commit real values:
Credentials are issued per product in the ZhylonID admin panel with least-privilege
scopes — request only internal.read if you never call getSyncUsers().
Usage
Via dependency injection (preferred — code against the contract, not the concrete class):
Or via the facade:
The package intentionally does not ship a Fortify
RegisterController. Registration flows are app-specific (Fortify, Breeze, custom) — wireZhylonIdServiceContract::userExists()into your own controller as shown above, per the Contract/Provider pattern in TECH_STACK.md.
Syncing users
Finds local users where zhylonid-service.sync.id_column (default zhylon_id) is null, pushes
them to ZhylonID, and backfills the returned remote ids. Requires the configured
zhylonid-service.sync.user_model to expose id, name, email, and the id column.
Security
See SECURITY.md for the vulnerability disclosure process, and note:
- The client refuses non-
https://endpoints by default (ZHYLON_ID_REQUIRE_HTTPS). - Access tokens are cached per client id (
sha256of the client id, never the secret) and are never logged. Failed token requests log only the HTTP status, never the response body. - Client secrets live in
.envonly — this package never ships or reads secrets from version-controlled config.
Testing
License
MIT — see LICENSE.
All versions of zhylonid-service with dependencies
illuminate/support Version ^11.0|^12.0|^13.0
illuminate/http Version ^11.0|^12.0|^13.0
illuminate/console Version ^11.0|^12.0|^13.0