Libraries tagged by RFC 2945

A client and server-side implementation in PHP of the Secure Remote Password (SRP-6a) protocol.

Go to Download

Thinbus SRP PHP is an implementation of the SRP-6a Secure Remote Password protocol.

Go to Download

Demo of Thinbus SRP PHP: a implementation of the SRP-6a Secure Remote Password protocol.

Go to Download

Tools for parsing & formatting the RFC 2445 iCalendar (.ics) specification

Go to Download

A contao module for downloading ical files generated from events. The output will follow RFC 2445 as best as possible.

Go to Download

Recurrence rules parser and iterator (RFC 5545 and RFC 2445 compliant)

Go to Download

A streaming MIME parser for PHP: RFC 5322 / 2045-2049 / 2047 / 2231 / 2183 / 6532, including message/rfc822 and message/global. No dependencies, no ext-mailparse.

Go to Download

RFC 9457 Problem Details for Yii3 and any PSR-7/PSR-15 application

Go to Download

Symfony 8 bundle for JSON-first API form handling with controller traits, data transformers, Doctrine validation, and RFC 9457 problem details error responses

Go to Download

Scramble operation transformers for Laravel REST APIs: namespace/attribute-driven tagging, RFC 9457 error responses, and spatie-Data query parameters.

Go to Download

Modern error handler with debug pages, RFC 9457 JSON errors, customizable renderers, solution providers, and PSR-15 middleware.

Go to Download

The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints). **Authentication.** All `/v1/_*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live__`, or `lk_test_` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`. The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back. **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents. **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`.

Go to Download

Cure your Laravel exception handling headaches. Manage errors, rate limits, and API responses using clean, declarative PHP 8.4 attributes.

Go to Download

RFC 9457 Problem Details for Laravel exceptions

Go to Download

Build a fully custom headless storefront - your own web app, mobile app, or POS - against a single OE Commerce store. Every endpoint below is namespaced under `/api/v1/store/...`. Building admin/back-office tooling instead? See [/docs/admin](/docs/admin). New here? [/guides/store](/guides/store) walks through getting a key, the anonymous cart session, and calling your first endpoints step by step - this page is the field-level reference to come back to afterward. ## Getting Started 1. Click the **Authorize** button at the top of this page. 2. Provide credentials: - **X-Commerce-Key** (always required) - your store's Store Access Key from Backoffice > Settings > Application APIs. `pk_store_...` (publishable) is safe for browser/mobile code; `sk_store_...` (secret) is server-to-server only and is rejected outright if a browser Origin header is present. - **Bearer** (only for endpoints acting on a specific customer - Account, Orders, Wishlists, etc.) - the token from **Auth > register** or **Auth > login**. Once authorized, you can explore and test all available endpoints directly from this interface. ## Anonymous Carts A guest cart is tracked by an `X-Session-Ref` header, not a cookie - the server generates one on your first request and echoes it back on every response after. Keep sending back whatever value you last received. Logging in carries that same cart forward onto the customer's account automatically, with no separate merge step. ## Errors Failures use RFC 9457 Problem Details (`application/problem+json`) with a stable `code` field for programmatic handling, e.g. `store_key_invalid`, `store_key_revoked`, `store_key_scope_denied`, `rate_limited`. A rejected *business* action (e.g. adding fewer than a product's minimum order quantity to the cart) instead comes back as HTTP 200 with `"success": false` and a human-readable `message` - always check `success` in the body, not just the HTTP status code. ## Rate Limits Requests are limited per Store Access Key (200/minute). The credential-stuffing surface (register/login/forgot-password/reset-password) is limited more tightly per caller IP (10 per 5 minutes). A 429 response includes a `Retry-After` header.

Go to Download