Libraries tagged by credential

A Steam SSO plugin for seamless integration with Steam accounts in Kirby, enabling users to log in with their Steam credentials. Simplifies authentication for gaming platforms and services.

Go to Download

An ergonomic Laravel wrapper for the Webling REST API featuring automated caching, credentials validation, robust API key redaction, and type-safe resource groups.

Go to Download

Module that makes it possible to login to Magento with SAASPASS credentials

Go to Download

Package that makes it possible to authenticate against a PHP-Rocker application using google user credentials (https://github.com/victorjonsson/PHP-Rocker)

Go to Download

Queue Laravel Logs send via curl and auth via OAuth2 Client Credentials Grant Token

Go to Download

OAuth 2.1 client (auth-code + PKCE, OIDC discovery, ID-token validation) and Client Credentials (M2M) support for Quiote.

Go to Download

## Descripción general API de nivel productivo para emitir Comprobantes Fiscales Electrónicos (e-CF) en la República Dominicana a través de la plataforma Pronesoft. ## Autenticación — OAuth 2.0 Client Credentials ### Pasos 1. Obtén tus credenciales desde el portal: - Sandbox: https://ecf.sandbox.pronesoft.com → Apps → Default Sandbox App - Producción: https://ecf.pronesoft.com → Integraciones → Apps → Crear App 2. Solicita un token via POST /oauth/token — válido por 24 horas (86400s). 3. Usa: Authorization: Bearer en cada request. 4. Renueva al recibir HTTP 401. Buena práctica: renovar 5 minutos antes del vencimiento. ### Delegación multi-empresa Para actuar en nombre de una empresa asociada (sucursal), agrega: x-tenant-id: NO envíes x-tenant-id cuando actúes como la empresa principal. ### Detalles del Sandbox - Usa cualquier RNC que comience con SBX (ej. SBX123456) — no se requiere certificado real. - Las secuencias son automáticas — no es necesario crearlas manualmente. - El campo environment en el cuerpo del documento DEBE ser TesteCF. ### Scopes disponibles business:read, business:create, business:update, members:read, members:invite, members:revoke, certificates:read, certificates:upload, certificates:update, documents:read, documents:create, documents:send, documents:receive, documents:update, approvals:read, approvals:commercial, sequences:read, sequences:create, sequences:update, sequences:cancel, business_info:read, certification:read, certification:write, reports:read

Go to Download

Sentinel for Polaris for PHP: a local risk engine on sign-up, sign-in, password reset and code sends (velocity, credential stuffing, bots, disposable domains, impossible travel, IP rules, devices, breached passwords) that observes, challenges or blocks

Go to Download

The Engine API is an HTTP API served by Docker Engine. It is the API the Docker client uses to communicate with the Engine, so everything the Docker client can do can be done with the API. Most of the client's commands map directly to API endpoints (e.g. `docker ps` is `GET /containers/json`). The notable exception is running containers, which consists of several API calls. # Errors The API uses standard HTTP status codes to indicate the success or failure of the API call. The body of the response will be JSON in the following format: ``` { "message": "page not found" } ``` # Versioning The API is usually changed in each release, so API calls are versioned to ensure that clients don't break. To lock to a specific version of the API, you prefix the URL with its version, for example, call `/v1.30/info` to use the v1.30 version of the `/info` endpoint. If the API version specified in the URL is not supported by the daemon, a HTTP `400 Bad Request` error message is returned. If you omit the version-prefix, the current version of the API (v1.40) is used. For example, calling `/info` is the same as calling `/v1.40/info`. Using the API without a version-prefix is deprecated and will be removed in a future release. Engine releases in the near future should support this version of the API, so your client will continue to work even if it is talking to a newer Engine. The API uses an open schema model, which means server may add extra properties to responses. Likewise, the server will ignore any extra query parameters and request body properties. When you write clients, you need to ignore additional properties in responses to ensure they do not break when talking to newer daemons. # Authentication Authentication for registries is handled client side. The client has to send authentication details to various endpoints that need to communicate with registries, such as `POST /images/(name)/push`. These are sent as `X-Registry-Auth` header as a Base64 encoded (JSON) string with the following structure: ``` { "username": "string", "password": "string", "email": "string", "serveraddress": "string" } ``` The `serveraddress` is a domain/IP without a protocol. Throughout this structure, double quotes are required. If you have already got an identity token from the [`/auth` endpoint](#operation/SystemAuth), you can just pass this instead of credentials: ``` { "identitytoken": "9cbaf023786cd7..." } ```

Go to Download

WebAuthn and passkeys for the PHPdot ecosystem — a production wrap of web-auth/webauthn-lib: ceremony orchestration, single-use challenges, duplicate-credential refusal, counter discipline, and an exception fence, with host-owned storage.

Go to Download

Factory class for creating PDO objects using credentials in external config files

Go to Download

Passkey (WebAuthn) login for PHP — a thin, safe wrapper around web-auth/webauthn-lib that owns the parts it deliberately leaves to you: challenge issuance, single-use expiry, credential persistence, counter replay detection. Framework-free core plus a Laravel bridge that augments Fortify.

Go to Download

Plugin to allow login via an nonce, created by an api call, to avoid the sharing of credentials when multiple people use the same account.

Go to Download

Passwordless and second-factor authentication for CakePHP 5 using WebAuthn passkeys: registration/assertion ceremonies, credential storage, an Authentication adapter, a browser helper and vanilla JS.

Go to Download

Build a fully custom headless storefront - your own web app, mobile app, or POS - against a single OE Commerce store. Every endpoint below is namespaced under `/api/v1/store/...`. Building admin/back-office tooling instead? See [/docs/admin](/docs/admin). New here? [/guides/store](/guides/store) walks through getting a key, the anonymous cart session, and calling your first endpoints step by step - this page is the field-level reference to come back to afterward. ## Getting Started 1. Click the **Authorize** button at the top of this page. 2. Provide credentials: - **X-Commerce-Key** (always required) - your store's Store Access Key from Backoffice > Settings > Application APIs. `pk_store_...` (publishable) is safe for browser/mobile code; `sk_store_...` (secret) is server-to-server only and is rejected outright if a browser Origin header is present. - **Bearer** (only for endpoints acting on a specific customer - Account, Orders, Wishlists, etc.) - the token from **Auth > register** or **Auth > login**. Once authorized, you can explore and test all available endpoints directly from this interface. ## Anonymous Carts A guest cart is tracked by an `X-Session-Ref` header, not a cookie - the server generates one on your first request and echoes it back on every response after. Keep sending back whatever value you last received. Logging in carries that same cart forward onto the customer's account automatically, with no separate merge step. ## Errors Failures use RFC 9457 Problem Details (`application/problem+json`) with a stable `code` field for programmatic handling, e.g. `store_key_invalid`, `store_key_revoked`, `store_key_scope_denied`, `rate_limited`. A rejected *business* action (e.g. adding fewer than a product's minimum order quantity to the cart) instead comes back as HTTP 200 with `"success": false` and a human-readable `message` - always check `success` in the body, not just the HTTP status code. ## Rate Limits Requests are limited per Store Access Key (200/minute). The credential-stuffing surface (register/login/forgot-password/reset-password) is limited more tightly per caller IP (10 per 5 minutes). A 429 response includes a `Retry-After` header.

Go to Download