PHP client — Validakey

Package

composer require validakey/validakey-php

Current line: 1.4.x. Configure via ValidakeyConfig or environment variables (VALIDAKEY_BASE_URL, VALIDAKEY_API_UUID, VALIDAKEY_USER_APP_ID, VALIDAKEY_SUBJECT, and optionally VALIDAKEY_API_PKEY).

Full getting-started walkthrough →

Core licence calls

Method	HTTP	Notes
`createToken()`	`POST /v1/m/`	Reuses the stored instance; handshakes only when needed.
`verifyToken()`	`POST /v1/v/`	Read-only unless consume is true.
`renewToken()`	`POST /v1/v/`	Adds time or uses without changing the vKey value.
`deleteToken()`	`DELETE /v1/v/`	Revokes; the record is kept.
`rotateInstance()`	`POST /v1/r/`	Preferred over repeating the handshake for routine rotation.

Multi-tenant subjects

$alpha = $client->forSubject('customer-42');
$beta  = $client->forSubject('customer-99');

$token = $alpha->createToken(new CreateTokenRequest(duration: 86400));

Each subject gets its own stored instance bucket, card, and vKeys. transferSubject() moves an Instance Entity after you open a transfer window from the account side.

Instance Entity cards

End customers pay for their own vKeys. The client never handles card numbers — Square’s Web Payments SDK or a hosted payment link does.

instancePaymentStatus()
attachInstanceCard() — web apps with Square’s SDK
requestInstancePaymentLink() — CLI and headless clients
detachInstanceCard()

Minting a priced vKey with no customer card returns ie_card_required (HTTP 402), distinct from your account’s payment_required.

Account path (optional)

Calls such as billing status, app management, and usage reporting require apiPKey. Prefer the dashboard for day-to-day account work; only automate these from a secure server.

Read access and authentication →