tausi / tausi-php

v0.2.0 2026-11-05 09:42 UTC

Requires

• php: >=8.1
• ext-curl: *
• ext-json: *

Requires (Dev)

• phpunit/phpunit: ^10.5 || ^11.0

MIT

• Authentication
• oauth
• auth
• laravel
• sessions
• tausi

Published on Packagist.org on 2026-11-05 09:42 UTC

README

Official PHP SDK for Tausi. It needs PHP 8.1 or later with ext-curl and ext-json, and has no other dependencies.

It contains two clients:

	Key	Use it for
Tausi\TausiBackend	secret key sk_…	Protecting your API (verifying session tokens) and managing your project's users.
Tausi\TausiClient	publishable key pk_…	Server-rendered apps where PHP signs the user in and keeps their token in $_SESSION.

composer require tausi/tausi-php

Protect your API

use Tausi\TausiBackend;

$tausi = new TausiBackend('https://tausi.app', getenv('TAUSI_SECRET_KEY'));

$auth = $tausi->authenticateRequest();          // reads Authorization: Bearer <token> from $_SERVER
if ($auth === null) {
    http_response_code(401);
    exit;
}
echo $auth->user->id, ' ', $auth->user->email;

authenticateRequest() and verifySession($token) return null when a token is invalid, expired, revoked or belongs to another project. They throw a TausiException only when the problem is on your side: a wrong key, a network failure or a 5xx response.

On Apache with PHP-CGI or FPM, the Authorization header may never reach PHP. Add CGIPassAuth On to the config, or pass the header explicitly: $tausi->authenticateRequest($request->header('Authorization')).

Laravel: see examples/laravel-middleware.php.

Manage users

$page = $tausi->listUsers(['q' => 'asha', 'page' => 1, 'pageSize' => 50]);   // Page<User>
foreach ($page->items as $user) {
    echo $user->email, ' ', $user->status, ' ', $user->activeSessions, ' ', $user->lastSignInAt;
}
$detail = $tausi->getUser($userId);             // ['user' => User, 'accounts' => ..., 'sessions' => ..., 'recentAudit' => ...]
$tausi->updateUser($userId, ['emailVerified' => true, 'name' => 'Asha']);
$tausi->revokeUserSessions($userId);           // sign out everywhere
$tausi->deleteUser($userId);
$tausi->listSessions();
$tausi->getProject();                           // startup check that the key works

Sign users in from PHP (TausiClient)

use Tausi\TausiClient;
use Tausi\TausiException;
use Tausi\TokenStore\PhpSessionTokenStore;

session_start();
$tausi = new TausiClient('https://tausi.app', 'pk_…', new PhpSessionTokenStore());

$tausi->signUp($email, $password, $name);       // sends a verification email
try {
    $result = $tausi->signIn($email, $password);
} catch (TausiException $e) {
    if ($e->errorCode === 'EMAIL_NOT_VERIFIED') { /* ... */ }
}

$tausi->getSession();  $tausi->getUser();  $tausi->updateUser(['name' => 'A']);
$tausi->forgotPassword($email);  $tausi->resetPassword($token, $new);
$tausi->changePassword($current, $new);         // signs out other devices
$tausi->listSessions();  $tausi->revokeOtherSessions();
$tausi->signOut();

PhpSessionTokenStore keeps the token on the server and regenerates the PHP session ID at sign-in. You can implement Tausi\TokenStore\TokenStore to keep the token somewhere else.

When Tausi renews a session token, the client stores the new one automatically. When Tausi rejects a token, the client clears it. See examples/plain-php.php.

Rate limits: when PHP calls Tausi on behalf of users, Tausi sees your server's IP, so per-IP sign-in limits apply to all your users together. For busy sign-in pages, let the browser call Tausi with the JavaScript client and verify the token in PHP with TausiBackend.

Social sign-in

// /login/google
$start = $tausi->startOAuth('google', 'https://app.example.com/auth/callback');  // must be on an allowed origin
$_SESSION['tausi_verifier'] = $start->codeVerifier;
header('Location: ' . $start->url);

// /auth/callback
$result = $tausi->handleOAuthRedirect($_GET, $_SESSION['tausi_verifier'] ?? '');
unset($_SESSION['tausi_verifier']);

Errors

Every API error is a Tausi\TausiException with these fields: status, errorCode, getMessage(), details, requestId and retryAfter.

errorCode	Meaning
INVALID_CREDENTIALS	Wrong email or password. Tausi doesn't say which.
EMAIL_NOT_VERIFIED	The password was right, but the email isn't verified yet.
UNAUTHENTICATED	There is no session, or it expired. The stored token is cleared.
INVALID_KEY	The key is wrong or was revoked.
RATE_LIMITED	Too many attempts. Wait retryAfter seconds.
NETWORK_ERROR / TIMEOUT	Tausi couldn't be reached (status is 0).

Custom HTTP client

Implement Tausi\Http\HttpClient (one send() method) to use Guzzle, Symfony HttpClient or a test double. Pass it as the third argument of TausiBackend or the fourth of TausiClient.

Development

composer install && composer test