Install M7 Identity SDK for a website

Choose web-php for browser login and session handling, token-php for local backend token validation, or both when the website has both responsibilities.

Install web-php

Stable release 0.1.3 is distributed as:

m7-identity-web-php-0.1.3.zip
m7-identity-web-php-0.1.3.zip.sha256
m7-identity-web-php-0.1.3.zip.manifest.json

Download the ZIP, SHA-256 checksum, and release manifest.

1. Collect registration values

Before installing, obtain the application's HTTPS origin, M7 client ID, registered token-endpoint authentication method, client secret when applicable, authorization and token endpoints, Identity acknowledgement endpoint, current and successor fingerprints, refresh mode, and post-login URL.

For the default installation path, register this redirect URI exactly:

https://YOUR_APPLICATION_ORIGIN/m7_sso_session/callback

2. Verify and extract the release

Keep the archive and checksum sidecar together, then verify with one available platform command:

shasum -a 256 -c m7-identity-web-php-0.1.3.zip.sha256

sha256sum -c m7-identity-web-php-0.1.3.zip.sha256

Extract into a non-public staging directory:

unzip m7-identity-web-php-0.1.3.zip -d ./staging

Copy only the extracted m7_sso_session directory into the application's public document root without renaming it. Keep documentation, examples, manifests, checksums, and install receipts outside the public root.

3. Configure the PHP worker

Supply the registered M7_* settings through the trusted Apache, PHP-FPM, or deployment secret environment. At minimum, configure the public origin, base path, client identity, registered client-authentication method, applicable secret, authorization and token endpoints, acknowledgement endpoint, fingerprints, refresh mode, pending-envelope key, and post-login URL.

In stable web-php 0.1.3, M7_FINGERPRINT and M7_NEW_FINGERPRINT accept the exact registered 32-byte value as either 64 hexadecimal or 43 canonical unpadded base64url characters. The SDK normalizes both inputs to the server's unchanged lowercase hexadecimal wire format. M7_PENDING_ENVELOPE_KEY accepts the same two encodings but remains a Web-SDK-local secret and is never sent to SSO.

Do not put a .env file, client secret, or pending-envelope key inside m7_sso_session. Reload the actual web PHP worker after configuration changes; the CLI and web worker may load different environments.

4. Configure routing

For Apache, enable mod_rewrite, permit FileInfo overrides for the installed directory, and disable directory indexes. Another web server must reproduce the package's extensionless route table, serve intended static files, deny direct root PHP filenames, and return 404 for unknown package paths.

5. Verify the installation

Lint the staged PHP files before deployment:

find ./staging/m7-identity-web-php-0.1.3/m7_sso_session -type f -name '*.php' -exec php -l {} \;

After reloading the web server and PHP worker, confirm that:

  • /m7_sso_session/ starts the configured login flow;
  • a GET request to the POST-only /m7_sso_session/me route returns 405;
  • direct requests for package PHP filenames are rejected;
  • unknown package paths return 404; and
  • the browser can load the package's versioned DPoP module.

Complete a non-production login, callback, acknowledgement, /me, /profile, refresh, and logout flow before using a production client registration.

Install token-php for backend validation

Stable release 0.1.2 is distributed with its checksum and manifest sidecars as m7-identity-token-php-0.1.2.zip.

Download the ZIP, SHA-256 checksum, and release manifest.

Verify the checksum, extract the package outside the public document root, and load its bundled autoloader:

require_once '/path/to/m7-identity-token-php-0.1.2/autoload.php';

The package requires PHP 8.1 or newer and OpenSSL. cURL is recommended for certificate retrieval, introspection, and UserInfo; supported PHP streams are the fallback transport.

Create the facade and validate an incoming serialized token with policy that is specific to the protected application:

use M7\Identity\M7IdentitySDK;

$identity = new M7IdentitySDK();
$report = $identity->validate($incomingAccessToken, [
    'audience' => 'https://api.example.m7.org/',
    'client_id' => 'YOUR_REGISTERED_CLIENT_ID',
    'principal_type' => 'consumer',
    'scope' => ['profile.read'],
    'cert_pem' => $trustedPublicCertificate,
]);

if (!$report->ok()) {
    throw new RuntimeException($report->reason());
}

Do not use token claims for authorization until signature, issuer, audience, time, and applicable scope or DPoP policy have all passed.