M7 Identity SDK
M7 Identity SDK provides integration packages for adding M7 sign-in, session handling, token validation, and live identity operations to applications and operational processes.
Choose the integration subject that matches where the identity work runs:
| Subject | Use it when | Current implementation |
|---|---|---|
| Website integration | A browser-facing PHP application needs M7 login and a same-origin session bridge, or its backend needs to validate incoming M7 tokens. | web-php 0.1.3 and token-php 0.1.2 stable releases |
| CLI and background processes | A PHP command, worker, scheduler, or operational process needs to validate or acquire a token, send an authenticated resource request, or call supported live identity operations. | token-php 0.1.2 and cli-php 0.1.1 stable releases |
Each section describes consumer capabilities and installation by subject. The package names identify the current implementation; they do not define the long-term documentation structure. Language-specific pages can be added below these subjects when another supported implementation is released.
M7 Identity SDK downloads
Current development-access PHP releases:
| Package | Version | Downloads |
|---|---|---|
| Web/PHP | 0.1.3 | ZIP · SHA-256 · Manifest |
| Token/PHP | 0.1.2 | ZIP · SHA-256 · Manifest |
| CLI/PHP | 0.1.1 | ZIP · SHA-256 · Manifest |
Verify each ZIP against its SHA-256 sidecar before extraction. The CLI requires Token/PHP 0.1.2.
Get started
The SDK packages are distributed under MTL-10. Packagist installation is not currently available.
Package and release status
Release claims are reconciled against each package's VERSION, metadata,
immutable archive, checksum, manifest, annotated release tag, tests, and
current support evidence:
| Package | Current status | Release boundary |
|---|---|---|
web-php |
0.1.3 stable artifact | The ZIP, checksum, manifest, package metadata, VERSION, and web-php-v0.1.3 tag identify the same immutable release. |
token-php |
0.1.2 stable artifact | The ZIP, checksum, manifest, package metadata, VERSION, and token-php-v0.1.2 tag identify the same immutable release. |
cli-php |
0.1.1 stable artifact | The ZIP, checksum, manifest, package metadata, VERSION, executable version, and cli-php-v0.1.1 tag identify the same immutable release. It requires token-php >=0.1.2 <0.2.0. |
Current verification on 2026-09-05 confirms that all three immutable ZIPs match their SHA-256 and manifest sidecars, pass clean-extraction checks, and rebuild byte-identically. The release gates run all 10 token conformance commands, all Web/PHP conformance checks, all 111 token tests, all 55 CLI tests, PHP lint, package-autoload checks, documentation-link checks, and the forbidden-file and secret-shape policies.
Current boundaries
The website package supplies a PHP backend-for-frontend integration for browser authorization and sessions. The token package supplies a PHP library for local validation, confidential-client token acquisition, online introspection, and UserInfo operations. It also supplies public/confidential device authorization, one-attempt token pickup, complete refresh-package exchange and acknowledgement, and schema-neutral authenticated resource requests.
The separate cli-php package is the dedicated m7-identity
executable adapter over token-php. Its supported command families are app,
profile, password, token, client-credentials, device-code, exchange,
ack, ensure, and authenticated resource request. The adapter owns
terminal prompting, device polling, command output and exit status, and
protected keychain persistence. The storage-neutral token library owns the
protocol operations and returns reports and complete bundles without choosing
CLI input, output, or storage. The CLI release verifier exercises the packaged
command against the immutable token-php 0.1.2 dependency.
Neither layer currently supplies authorization-code acquisition or outbound DPoP proof generation. Callers of DPoP-bound operations must provide a fresh externally generated proof for each applicable request.
Security
Use HTTPS, verify release checksums before installation, and keep access tokens, refresh credentials, client secrets, DPoP proofs, session cookies, and deployment keys out of source control, URLs, command histories, logs, and public documentation.
Report private security issues to security@m7.org. Commercial licensing inquiries may be sent to legal@m7.org.