Sign in with M7 on a PHP site

The announcement said you can start. This is the first path: put Sign in with M7 on a PHP site using web-php 0.1.5.

The package is a same-origin backend-for-frontend. It owns OAuth state, PKCE, the code exchange, and HttpOnly session cookies. Your app owns pages, routing around /m7_sso_session, and when to ask for the current session. Do not rename the installed directory.

The full contract is the website installation guide. This is the full-page starter, checked for Web/PHP 0.1.5 on 2 October 2026. The SDK installation page still lists 0.1.4; the 0.1.5 ZIP, checksum and manifest below have been verified separately. The newer hosted PHP page integration adds Active Tags for embedded completion as a separate next step.

1. Register the app

Create a development account, then register an OAuth application. The redirect URI for the default install is exact:

https://YOUR_APPLICATION_ORIGIN/m7_sso_session/callback

You will need the origin, client ID, token-endpoint authentication method, client secret if the client is confidential, authorization and token endpoints, acknowledgement endpoint, fingerprints, refresh mode, and a same-origin post-login URL. Issuer is https://sso.user.m7.org. PKCE is S256 only.

2. Verify the zip

m7-identity-web-php-0.1.5.zip
m7-identity-web-php-0.1.5.zip.sha256
m7-identity-web-php-0.1.5.zip.manifest.json

ZIP · SHA-256 · manifest

shasum -a 256 -c m7-identity-web-php-0.1.5.zip.sha256
unzip m7-identity-web-php-0.1.5.zip -d ./staging

For a new installation, copy only the extracted m7-identity-web-php-0.1.5/m7_sso_session into the public document root. If the route already exists, follow the package’s upgrade instructions before replacing it. Keep the docs, manifest, and checksums out of the web root. Do not put a .env, client secret, or pending-envelope key inside that directory.

3. Configure the PHP worker

Set the registered M7_* values on the Apache / PHP-FPM process that serves the site. Fingerprints accept 64 hex or 43 unpadded base64url characters; the SDK still sends lowercase hex on the wire. For ACK refresh modes, provide M7_PENDING_ENVELOPE_KEY: an independent 32-byte deployment secret encoded as 64 hex or 43 unpadded base64url characters. It stays local to the SDK. Keep M7_RESPONSE_MODE=query for this full-page path and configure the same-origin post-login URL. Reload the worker after changes. The CLI environment is not the web worker.

For Apache, enable mod_rewrite, permit FileInfo overrides for the directory, and disable directory indexes. Other servers must reproduce the package’s extensionless route table, reject direct root PHP filenames, and return 404 for unknown package paths.

4. Start login and read the session

window.location.assign("/m7_sso_session/");

async function readM7Session() {
  const response = await fetch("/m7_sso_session/me", {
    method: "POST",
    credentials: "include",
    headers: { "Content-Type": "application/json" },
    body: "{}",
  });

  const session = await response.json();
  if (!response.ok || session?.ok !== true) {
    throw new Error(session?.error_description || session?.error ||
      "M7 session request failed");
  }
  return session;
}

const session = await readM7Session();

Call this from your page’s JavaScript module or another async context. Treat HTTP status and ok together. The success envelope contains token, expires_in, active and source; a failure uses a string error and may include error_description. Show a sign-in prompt when the request fails. Keep any access token from /me in memory. /profile uses the HttpOnly cookie and does not return the token. Never call /callback-process yourself; the package callback page owns that hop.

A GET to /m7_sso_session/me should be 405. Direct PHP filenames in the package should be rejected.

5. Confirm the loop

On a non-production registration, run login, callback, acknowledgement, /me, /profile, refresh, and logout through the real HTTPS origin before you point a production client at it.

If the site already brokers GitHub or Discord itself, use the OIDC-Connect PHP pattern so M7 is one button beside the others. The website still owns local accounts and linking. Do not key accounts on email alone.

PHP 8.1+, OpenSSL, and cURL. License is MTL-10. Packagist is not available.

That is the install. Next is policy: people, machines, and tenants are not the same principal.