README

Invitation infrastructure for modern apps

Vortex handles the complete invitation lifecycle — sending invites via email/SMS/share links, tracking clicks and conversions, managing referral programs, and optimizing your invitation flows with A/B testing. Learn more about Vortex →

Why This SDK?

This backend SDK securely signs user data for Vortex components. Your API key stays on your server, while the signed token is passed to the frontend where Vortex components render the invitation UI.

Keep your API key secure — it never touches the browser
Sign user identity for attribution — know who sent each invitation
Control what data components can access via scoped tokens
Verify webhook signatures for secure event handling

How It Works

Vortex uses a split architecture: your backend signs tokens with the SDK, and your frontend renders components that use those tokens to securely interact with Vortex.

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│   Your Server   │     │  User Browser   │     │  Vortex Cloud   │
│    (this SDK)   │     │   (component)   │     │                 │
└────────┬────────┘     └────────┬────────┘     └────────┬────────┘
         │                       │                       │
         │  1. generateToken()   │                       │
         │◄──────────────────────│                       │
         │                       │                       │
         │  2. Return token      │                       │
         │──────────────────────►│                       │
         │                       │                       │
         │                       │  3. Component calls   │
         │                       │     API with token    │
         │                       │──────────────────────►│
         │                       │                       │
         │                       │  4. Render UI,        │
         │                       │     send invitations  │
         │                       │◄──────────────────────│
         │                       │                       │

Integration Flow

1. Install the backend SDK [backend]

Add this SDK to your PHP project

composer require teamvortexsoftware/vortex-php-sdk

2. Initialize the client [backend]

Create a Vortex client with your API key (keep this on the server!)

<?php
use TeamVortexSoftware\VortexSDK\VortexClient;

$client = new VortexClient(getenv('VORTEX_API_KEY'));

3. Generate a token for the current user [backend]

When a user loads a page with a Vortex component, generate a signed token on your server

$token = $client->generateToken([
    'user' => ['id' => $currentUser->id]
]);

4. Pass the token to your frontend [backend]

Include the token in your page response or API response

return response()->json(['vortexToken' => $token]);

5. Render a Vortex component with the token [frontend]

Use the React/Angular/Web Component with the token

import { VortexInvite } from "@teamvortexsoftware/vortex-react";

<VortexInvite token={vortexToken} />

6. Vortex handles the rest [vortex]

The component securely communicates with Vortex servers, displays the invitation UI, sends emails/SMS, tracks conversions, and reports analytics

Security Model

⚠️ Important: Your Vortex API key is a secret that grants full access to your account. It must never be exposed to browsers or client-side code.

By signing tokens on your server, you:

Keep your API key secret (it never leaves your server)
Control exactly what user data is shared with components
Ensure invitations are attributed to real, authenticated users
Prevent abuse — users can only send invitations as themselves

When Signing is Optional

Token signing is controlled by your component configuration in the Vortex dashboard. If "Require Secure Token" is enabled, requests without a valid token will be rejected. If disabled (e.g., for public referral programs), components work without backend signing.

Quick Start

Generate a secure token for Vortex components

<?php
use TeamVortexSoftware\VortexSDK\VortexClient;

$client = new VortexClient(getenv('VORTEX_API_KEY'));

// Generate a token for the current user
$token = $client->generateToken([
    'user' => ['id' => 'user-123', 'email' => 'user@example.com']
]);

// Pass the token to your frontend component

Installation

composer require teamvortexsoftware/vortex-php-sdk

Initialization

$client = new VortexClient(getenv('VORTEX_API_KEY'));

Environment Variables

Variable	Required	Description
`VORTEX_API_KEY`	✓	Your Vortex API key

Core Methods

These are the methods you'll use most often.

`generateToken()`

Generate a signed token for use with Vortex widgets

Signature:

generateToken(array $payload, ?array $options = null): string

Parameters:

Name	Type	Required	Description
`payload`	`array`	✓	Data to sign (user, component, scope, vars, etc.)
`options`	`array\|null`	✓	Optional configuration (expiresIn)

Returns: string — Signed JWT token

Example:

$vortex = new VortexClient($_ENV['VORTEX_API_KEY']);
$token = $vortex->generateToken(['user' => ['id' => 'user-123']]);
$token = $vortex->generateToken([
'component' => 'widget-abc',
'user' => ['id' => 'user-123', 'name' => 'Peter'],
'scope' => 'workspace_456',
'vars' => ['company_name' => 'Acme']
]);
$token = $vortex->generateToken(
['user' => ['id' => 'user-123']],
['expiresIn' => '1h']  // or 3600 for seconds
);
public function generateToken(array $payload, ?array $options = null): string

Added in v0.8.0

`getInvitation()`

Get a specific invitation by ID public function getInvitation(string $invitationId): array

Signature:

getInvitation(string $invitationId): array

Parameters:

Name	Type	Required	Description
`invitationId`	`string`	✓	The invitation ID

Returns: array — The invitation data

Added in v0.1.0

`acceptInvitation()`

Accept a single invitation (recommended method) This is the recommended method for accepting invitations.

Signature:

acceptInvitation(string $invitationId, array $user): array

Parameters:

Name	Type	Required	Description
`invitationId`	`string`	✓	Single invitation ID to accept
`user`	`array`	✓	User array with 'email'/'phone'/'name' keys

Returns: array — The accepted invitation result

Example:

$user = ['email' => 'user@example.com', 'name' => 'John Doe'];
$result = $client->acceptInvitation('inv-123', $user);
public function acceptInvitation(string $invitationId, array $user): array

Added in v0.6.0

All Methods

Click to expand full method reference

`getInvitationsByTarget()`

Get invitations by target (email or sms) public function getInvitationsByTarget(string $targetType, string $targetValue): array

Signature:

getInvitationsByTarget(string $targetType, string $targetValue): array

Parameters:

Name	Type	Required	Description
`targetType`	`string`	✓	Type of target ('email' or 'phone')
`targetValue`	`string`	✓	Target value (email address or phone number)

Returns: array — List of invitations

Added in v0.1.0

`revokeInvitation()`

Revoke (delete) an invitation public function revokeInvitation(string $invitationId): array

Signature:

revokeInvitation(string $invitationId): array

Parameters:

Name	Type	Required	Description
`invitationId`	`string`	✓	The invitation ID to revoke

Returns: array — Success response

Added in v0.1.0

`acceptInvitations()`

Accept multiple invitations Supports three formats: 1. User array (preferred): ['email' => '...', 'phone' => '...', 'name' => '...'] 2. Target array (deprecated): ['type' => 'email', 'value' => '...'] 3. Array of targets (deprecated): [['type' => 'email', 'value' => '...'], ...]

Signature:

acceptInvitations(array $invitationIds, array $userOrTarget): array

Parameters:

Name	Type	Required	Description
`invitationIds`	`array`	✓	List of invitation IDs to accept
`userOrTarget`	`array`	✓	User array with 'email'/'phone'/'name' keys, OR legacy target(s)

Returns: array — The accepted invitation result

Example:

$user = ['email' => 'user@example.com', 'name' => 'John Doe'];
$result = $client->acceptInvitations(['inv-123'], $user);
$target = ['type' => 'email', 'value' => 'user@example.com'];
$result = $client->acceptInvitations(['inv-123'], $target);
public function acceptInvitations(array $invitationIds, array $userOrTarget): array

Added in v0.1.0

`deleteInvitationsByScope()`

Delete all invitations for a specific group public function deleteInvitationsByScope(string $scopeType, string $scope): array

Signature:

deleteInvitationsByScope(string $scopeType, string $scope): array

Parameters:

Name	Type	Required	Description
`scopeType`	`string`	✓	The group type
`scope`	`string`	✓	The group ID

Returns: array — Success response

Added in v0.4.0

`getInvitationsByScope()`

Get all invitations for a specific group public function getInvitationsByScope(string $scopeType, string $scope): array

Signature:

getInvitationsByScope(string $scopeType, string $scope): array

Parameters:

Name	Type	Required	Description
`scopeType`	`string`	✓	The group type
`scope`	`string`	✓	The group ID

Returns: array — List of invitations for the group

Added in v0.4.0

`reinvite()`

Reinvite a user (send invitation again) public function reinvite(string $invitationId): array

Signature:

reinvite(string $invitationId): array

Parameters:

Name	Type	Required	Description
`invitationId`	`string`	✓	The invitation ID to reinvite

Returns: array — The reinvited invitation result

Added in v0.2.0

`getAutojoinDomains()`

Get autojoin domains configured for a specific scope

Signature:

getAutojoinDomains(string $scopeType, string $scope): array

Parameters:

Name	Type	Required	Description
`scopeType`	`string`	✓	The type of scope (e.g., "organization", "team", "project")
`scope`	`string`	✓	The scope identifier (customer's group ID)

Returns: array — Response with 'autojoinDomains' array and 'invitation'

Example:

$result = $client->getAutojoinDomains('organization', 'acme-org');
foreach ($result['autojoinDomains'] as $domain) {
echo "Domain: " . $domain['domain'] . "\n";
}
public function getAutojoinDomains(string $scopeType, string $scope): array

Added in v0.6.0

`configureAutojoin()`

Configure autojoin domains for a specific scope This endpoint syncs autojoin domains - it will add new domains, remove domains not in the provided list, and deactivate the autojoin invitation if all domains are removed (empty array).

Signature:

configureAutojoin(
        string $scope,
        string $scopeType,
        array $domains,
        string $componentId,
        ?string $scopeName = null,
        ?array $metadata = null
    ): array

Parameters:

Name	Type	Required	Description
`scope`	`string`	✓	The scope identifier (customer's group ID)
`scopeType`	`string`	✓	The type of scope (e.g., "organization", "team")
`domains`	`array`	✓	Array of domain strings to configure for autojoin
`componentId`	`string`	✓	The component ID
`scopeName`	`string\|null`	✓	Optional display name for the scope
`metadata`	`array\|null`	✓	Optional metadata to attach to the invitation

Returns: array — Response with 'autojoinDomains' array and 'invitation'

Example:

$result = $client->configureAutojoin(
'acme-org',
'organization',
['acme.com', 'acme.org'],
'component-123',
'Acme Corporation'
);
public function configureAutojoin(
string $scope,
string $scopeType,
array $domains,
string $componentId,
?string $scopeName = null,
?array $metadata = null
): array

Added in v0.6.0

Types

Click to expand type definitions

`GenerateTokenPayload`

Payload for generateToken() - used to generate secure tokens for Vortex components

Field	Type	Description
`user`	`TokenUser`	The authenticated user who will be using the Vortex component
`component`	`string`	Component ID to generate token for (from your Vortex dashboard)
`scope`	`string`	Scope identifier to restrict invitations (format: "scopeType:scopeId")
`vars`	`array`	Custom variables to pass to the component for template rendering

`TokenUser`

User data for token generation - represents the authenticated user sending invitations

Field	Type	Required	Description
`id`	`string`	✓	Unique identifier for the user in your system. Used to attribute invitations.
`email`	`string`		User's email address. Used for reply-to in invitation emails.
`name`	`string`		Display name shown to invitation recipients (e.g., "John invited you")
`avatarUrl`	`string`		URL to user's avatar image. Displayed in invitation emails and widgets.
`adminScopes`	`string[]`		List of scope IDs where this user has admin privileges
`allowedEmailDomains`	`string[]`		Restrict invitations to specific email domains (e.g., ["acme.com"])

`AcceptUser`

User data for accepting invitations - identifies who accepted the invitation

Field	Type	Description
`email`	`string`	Email address of the accepting user. At least one of email or phone is required.
`phone`	`string`	Phone number with country code. At least one of email or phone is required.
`name`	`string`	Display name of the accepting user (shown in notifications to inviter)
`isExisting`	`bool`	Whether user was already registered. true=existing, false=new signup, null=unknown.

`CreateInvitationTarget`

Target specification when creating an invitation - where to send the invite

Field	Type	Required	Description
`type`	`string`	✓	Delivery channel: "email", "phone", "share", or "internal"
`value`	`string`	✓	Target address: email address, phone number with country code, or internal user ID
`name`	`string`		Display name of the recipient (used in email greetings)

`CreateInvitationScope`

Scope specification when creating an invitation - what group/team to invite into

Field	Type	Required	Description
`type`	`string`	✓	Scope type (e.g., "team", "organization", "workspace")
`groupId`	`string`	✓	Your internal identifier for this scope/group
`name`	`string`	✓	Display name for the scope (shown in invitation emails)

`Identifier`

Email or phone identifier for looking up users

Field	Type	Required	Description
`type`	`string`	✓	Identifier type: "email" or "phone"
`value`	`string`	✓	The email address or phone number (with country code for phone)

`ConfigureAutojoinRequest`

Request to configure autojoin domains for a scope

Field	Type	Required	Description
`scopeType`	`string`	✓	Type of scope (e.g., "team", "workspace")
`scopeId`	`string`	✓	Your internal identifier for the scope
`domains`	`string[]`	✓	List of email domains to enable autojoin for (e.g., ["acme.com"])

`SyncInternalInvitationRequest`

Request to sync an internal invitation (for tracking invitations made outside Vortex)

Field	Type	Required	Description
`inviterId`	`string`	✓	Your internal user ID for the person who sent the invitation
`target`	`CreateInvitationTarget`	✓	The invitation recipient
`scopes`	`CreateInvitationScope[]`		Scopes/groups the invitation grants access to

`InvitationResult`

Complete invitation details as returned by the Vortex API

Field	Type	Required	Description
`id`	`string`	✓	Unique identifier for this invitation
`accountId`	`string`	✓	Your Vortex account ID
`clickThroughs`	`int`	✓	Number of times the invitation link was clicked
`formSubmissionData`	`array\|null`		Invitation form data submitted by the user, including invitee identifiers (such as email addresses, phone numbers, or internal IDs) and the values of any custom fields.
`configurationAttributes`	`array\|null`		Deprecated: Use formSubmissionData instead. Contains the same data.
`createdAt`	`string`	✓	ISO 8601 timestamp when the invitation was created
`deactivated`	`bool`	✓	Whether this invitation has been revoked or expired
`deliveryCount`	`int`	✓	Number of times the invitation was sent (including reminders)
`deliveryTypes`	`string[]`	✓	Channels used to deliver: "email", "phone", "share", "internal"
`foreignCreatorId`	`string`	✓	Your internal user ID for the person who created this invitation
`invitationType`	`string`	✓	Type: "single_use", "multi_use", or "autojoin"
`status`	`string`	✓	Current status: queued, sending, sent, delivered, accepted, shared
`target`	`InvitationTarget[]`	✓	List of invitation recipients with their contact info and status
`views`	`int`	✓	Number of times the invitation page was viewed
`groups`	`InvitationScope[]`	✓	Scopes (teams/orgs) this invitation grants access to
`expired`	`bool`	✓	Whether this invitation has passed its expiration date
`expires`	`string`		ISO 8601 timestamp when this invitation expires
`inviter`	`Inviter`		Information about who sent the invitation

`InvitationTarget`

Target recipient of an invitation (from API response)

Field	Type	Required	Description
`type`	`string`	✓	Delivery channel: "email", "phone", "share", or "internal"
`value`	`string`	✓	Target address: email, phone number with country code, or share link ID
`name`	`string`		Display name of the recipient
`avatarUrl`	`string`		Avatar URL for the recipient
`status`	`string`		Delivery status for this specific target

`InvitationScope`

Scope/group that the invitation grants access to (from API response)

Field	Type	Required	Description
`id`	`string`	✓	Vortex internal UUID for this scope record
`accountId`	`string`	✓	Your Vortex account ID
`groupId`	`string`	✓	Your internal scope/group identifier
`type`	`string`	✓	Scope type (e.g., "team", "organization", "workspace")
`name`	`string`	✓	Display name for the scope
`createdAt`	`string`	✓	ISO 8601 timestamp when the scope was created

`InvitationAcceptance`

Details about an invitation acceptance event

Field	Type	Required	Description
`id`	`string`	✓	Unique identifier for this acceptance record
`invitationId`	`string`	✓	ID of the invitation that was accepted
`email`	`string`		Email of the user who accepted
`phone`	`string`		Phone of the user who accepted
`name`	`string`		Name of the user who accepted
`isExisting`	`bool`		Whether the user already had an account
`createdAt`	`string`	✓	ISO 8601 timestamp when the acceptance occurred

`Inviter`

Information about the user who sent an invitation

Field	Type	Required	Description
`id`	`string`	✓	Your internal user ID for the inviter
`email`	`string`		Email address of the inviter
`name`	`string`		Display name of the inviter
`avatarUrl`	`string`		Avatar URL of the inviter

`AutojoinDomain`

Autojoin domain configuration - users with matching email domains automatically join

Field	Type	Required	Description
`id`	`string`	✓	Unique identifier for this autojoin configuration
`domain`	`string`	✓	Email domain that triggers autojoin (e.g., "acme.com")

`AutojoinDomainsResponse`

Response from getAutojoinDomains()

Field	Type	Required	Description
`domains`	`AutojoinDomain[]`	✓	List of configured autojoin domains

`SyncInternalInvitationResponse`

Response from syncInternalInvitation()

Field	Type	Required	Description
`invitation`	`InvitationResult`	✓	The created or updated invitation
`created`	`bool`	✓	True if a new invitation was created, false if existing was updated

`VortexWebhookEvent`

Webhook event payload delivered to your endpoint

Field	Type	Required	Description
`id`	`string`	✓	Unique identifier for this webhook delivery
`type`	`string`	✓	Event type (e.g., "invitation.accepted", "member.created")
`timestamp`	`string`	✓	ISO 8601 timestamp when the event occurred
`data`	`array`	✓	Event-specific payload data

Webhooks

Webhooks let your server receive real-time notifications when events happen in Vortex. Use them to sync invitation state with your database, trigger onboarding flows, update your CRM, or send internal notifications.

Setup

Go to your Vortex dashboard → Integrations → Webhooks tab
Click "Add Webhook"
Enter your endpoint URL (must be HTTPS in production)
Copy the signing secret — you'll use this to verify webhook signatures
Select which events you want to receive

Verifying Webhooks

Always verify webhook signatures using VortexWebhooks::verifySignature() to ensure requests are from Vortex. The signature is sent in the X-Vortex-Signature header.

Example: Laravel webhook handler

<?php
use TeamVortexSoftware\VortexSDK\VortexWebhooks;
use Illuminate\Http\Request;

class WebhookController extends Controller
{
    public function handleVortex(Request $request)
    {
        $webhooks = new VortexWebhooks(env('VORTEX_WEBHOOK_SECRET'));

        $payload = $request->getContent();
        $signature = $request->header('X-Vortex-Signature');

        // Verify the signature
        if (!$webhooks->verifySignature($payload, $signature)) {
            return response()->json(['error' => 'Invalid signature'], 400);
        }

        // Parse the event
        $event = $webhooks->parseEvent($payload);

        switch ($event['type']) {
            case 'invitation.accepted':
                // User accepted an invitation — activate their account
                Log::info('Accepted: ' . json_encode($event['data']));
                break;
            case 'member.created':
                // New member joined via invitation
                Log::info('New member: ' . json_encode($event['data']));
                break;
        }

        return response()->json(['received' => true]);
    }
}

Common Use Cases

Activate users on acceptance

When invitation.accepted fires, mark the user as active in your database and trigger your onboarding flow.

Track invitation performance

Monitor email.delivered, email.opened, and link.clicked events to measure invitation funnel metrics.

Sync team membership

Use member.created and group.member.added to keep your internal membership records in sync.

Alert on delivery issues

Watch for email.bounced events to proactively reach out via alternative channels.

Supported Events

Event	Description
`invitation.created`	A new invitation was created
`invitation.accepted`	An invitation was accepted by the recipient
`invitation.deactivated`	An invitation was deactivated (revoked or expired)
`invitation.email.delivered`	Invitation email was successfully delivered
`invitation.email.bounced`	Invitation email bounced (invalid address)
`invitation.email.opened`	Recipient opened the invitation email
`invitation.link.clicked`	Recipient clicked the invitation link
`invitation.reminder.sent`	A reminder email was sent for a pending invitation
`member.created`	A new member was created from an accepted invitation
`group.member.added`	A member was added to a scope/group
`deployment.created`	A new deployment configuration was created
`deployment.deactivated`	A deployment was deactivated
`abtest.started`	An A/B test was started
`abtest.winner_declared`	An A/B test winner was declared
`email.complained`	Recipient marked the email as spam

Error Handling

All SDK errors extend Exception.

Error	Description
`VortexWebhookSignatureException`	Thrown when webhook signature verification fails. Check that you are using the raw request body and the correct signing secret.
`Exception`	Thrown for validation errors (e.g., missing API key, invalid parameters)

teamvortexsoftware / vortex-php-sdk

Maintainers

Package info

Statistics

Security

README

Why This SDK?

How It Works

Integration Flow

Security Model

When Signing is Optional

Quick Start

Installation

Initialization

Environment Variables

Core Methods

generateToken()

getInvitation()

acceptInvitation()

All Methods

getInvitationsByTarget()

revokeInvitation()

acceptInvitations()

deleteInvitationsByScope()

getInvitationsByScope()

reinvite()

getAutojoinDomains()

configureAutojoin()

Types

GenerateTokenPayload

TokenUser

AcceptUser

CreateInvitationTarget

CreateInvitationScope

Identifier

ConfigureAutojoinRequest

SyncInternalInvitationRequest

InvitationResult

InvitationTarget

InvitationScope

InvitationAcceptance

Inviter

AutojoinDomain

AutojoinDomainsResponse

SyncInternalInvitationResponse

VortexWebhookEvent

Webhooks

Setup

Verifying Webhooks

Example: Laravel webhook handler

Common Use Cases

Supported Events

Error Handling

`generateToken()`

`getInvitation()`

`acceptInvitation()`

`getInvitationsByTarget()`

`revokeInvitation()`

`acceptInvitations()`

`deleteInvitationsByScope()`

`getInvitationsByScope()`

`reinvite()`

`getAutojoinDomains()`

`configureAutojoin()`

`GenerateTokenPayload`

`TokenUser`

`AcceptUser`

`CreateInvitationTarget`

`CreateInvitationScope`

`Identifier`

`ConfigureAutojoinRequest`

`SyncInternalInvitationRequest`

`InvitationResult`

`InvitationTarget`

`InvitationScope`

`InvitationAcceptance`

`Inviter`

`AutojoinDomain`

`AutojoinDomainsResponse`

`SyncInternalInvitationResponse`

`VortexWebhookEvent`