Home

authwave/php-client connects a PHP application to an Authwave provider, so visitors can sign in without us building the authentication screens ourselves.

Imagine we are adding a members' area to a website. Our application needs to know who the visitor is, while the provider handles the steps needed to authenticate them. The client joins those two parts together: it sends the browser to the provider, reads the encrypted response when the browser returns, and remembers the user in the application's session.

Authwave is open source and can be self-hosted. The client uses login.authwave.com by default, or we can point it at our own provider.

Once we have constructed an Authenticator, our page can work with the authenticated user:

if($auth->isLoggedIn()) {
	$user = $auth->getAuthUser();
	echo "Welcome back, ", htmlspecialchars($user->email, ENT_QUOTES, "UTF-8");
}
else {
	echo '<a href="/login.php">Log in</a>';
}

The Quick start guide shows the complete setup, including Composer, the client key and the session.

• Starting the provider login flow and handling the encrypted return request.
• Restoring an authenticated user from the PHP session.
• Reading the user's ID, email address and any supplied custom fields.
• Calling application code when a new authentication completes.
• Building provider URIs and accepting custom session and redirect handlers.

Our application still decides what a user is allowed to do. Being logged in gives us an identity; access to an order, project or administrative action belongs in our application's own permission checks.

Start with the Overview, or follow the Quick start guide to add a first login page.