customy / access

v0.2.0 2026-09-26 09:44 UTC

Requires

• php: >=8.1
• ext-json: *

Suggests

• ext-curl: Required by the default CurlTransport.
• ext-openssl: Required to verify signed feature flag snapshots (verify_signature).
• psr/http-client: Future PSR-18 transport adapter support.

MIT

• php
• sdk
• access
• iam
• feature-flags
• experiments
• customy

Published on Packagist.org on 2026-09-26 16:31 UTC

README

Official PHP SDK for Customy Access.

This package is the server-side foundation for PHP apps and the official WordPress plugin. It is intentionally transport-agnostic so it can run with cURL, WordPress HTTP API, or a future PSR-18 adapter without changing product code.

Install

composer require customy/access

Usage

use Customy\Access\CustomyAccessClient;

$access = new CustomyAccessClient([
    'base_url' => 'https://access.customy.ai',
    'api_key' => getenv('CUSTOMY_ACCESS_API_KEY'),
    'environment_id' => getenv('CUSTOMY_ACCESS_ENVIRONMENT_ID'),
]);

$users = $access->users()->list([
    'limit' => 50,
]);

Feature flags

Local evaluation of the environment's published flags — the same assignment as the JavaScript SDK (tests/fixtures/flags-parity.json, generated from @customyai/flags-eval, pins it bit for bit).

use Customy\Access\Flags\FlagsClient;
use Customy\Access\MachineTokenProvider;

$flags = new FlagsClient([
    'base_url' => 'https://access-api.customy.ai',
    'token_provider' => new MachineTokenProvider('https://access-api.customy.ai', getenv('CUSTOMY_CLIENT_ID'), getenv('CUSTOMY_CLIENT_SECRET'), scopes: ['flags:read']),
    'verify_signature' => true,          // snapshot signed by the Access issuer (JWKS), content checked
    'snapshot' => apcu_fetch('customy.flags') ?: null, // PHP keeps nothing between requests
]);
$flags->refresh();                        // 304 when unchanged
apcu_store('customy.flags', $flags->snapshot());

if ($flags->getBooleanValue('checkout.new_flow', false, ['key' => $userId])) {
    // …
}
$flags->trackConversion('checkout.new_flow', ['key' => $userId], value: 49.9, metric: 'purchase');
$flags->flush();                          // impressions (one per flag/key/treatment/hour) and conversions

Tests: php tests/flags.php (no Composer needed).

Design Rules

• API keys are server-side only.
• WordPress consumes this SDK instead of duplicating HTTP logic.
• All requests include Customy context headers when configured.
• API exceptions preserve status code, request ID, and response body.
• Low-level request() remains available for complete OpenAPI coverage while generated PHP resources are added.