evansims/openfga-php

Stop writing authorization logic. Start asking questions. OpenFGA high performance relationship-based access control for PHP.

v1.5.0 2025-06-22 02:11 UTC

Requires

• php: ^8.3
• ext-ctype: *
• ext-json: *
• psr-discovery/all: ^1
• psr/http-client-implementation: ^1
• psr/http-factory-implementation: ^1
• psr/http-message-implementation: ^1

Requires (Dev)

• ergebnis/composer-normalize: ^2
• friendsofphp/php-cs-fixer: ^3
• kriswallsmith/buzz: ^1.3
• nyholm/psr7: ^1.8
• open-telemetry/api: ^1.1
• open-telemetry/sdk: ^1.1
• pestphp/pest: ^3
• phpmd/phpmd: ^2.15
• phpmetrics/phpmetrics: ^3.0@RC
• phpstan/phpstan: ^2
• phpstan/phpstan-strict-rules: ^2
• psr-mock/http-client-implementation: ^1
• psr-mock/http-factory-implementation: ^1
• psr-mock/http-message-implementation: ^1
• rector/rector: ^2
• vimeo/psalm: ^6
• wikimedia/composer-merge-plugin: ^2

Suggests

• open-telemetry/api: For observability support with metrics, tracing and logging
• open-telemetry/sdk: For OpenTelemetry SDK implementation
• tbachert/spi: For automatic service provider registration in SPI-compatible frameworks

Apache-2.0

• Evan Sims

• authorization
• security
• Authentication
• permissions
• rbac
• access-control
• abac
• observability
• opentelemetry
• openfga
• fine-grained-authorization
• relationship-based-access-control
• zanzibar
• auth0-fga
• policy-engine

README

OpenFGA PHP SDK

Stop writing authorization logic. Start asking questions.

composer require evansims/openfga-php

Every app needs permissions. Most developers end up with authorization logic scattered across controllers, middleware, and business logic. Changes break things. New features require touching dozens of files.

OpenFGA solves this. Define your authorization rules once, query them anywhere. This SDK provides a modern PHP interface to OpenFGA and Auth0 FGA.

Installation

composer require evansims/openfga-php

Quickstart

use OpenFGA\Client;
use function OpenFGA\{allowed, tuple};

$client = new Client(url: 'http://localhost:8080');

// Instead of scattered if statements in your controllers:
if ($user->isAdmin() || $user->owns($document) || $user->team->canEdit($document)) {
    // ...
}

// Ask OpenFGA:
$canEdit = allowed(
    client: $client,
    store: 'my-store',
    model: 'my-model',
    tuple: tuple('user:alice', 'editor', 'document:readme')
);

// Zero business logic coupling. Pure authorization.

See the documentation to get started.

Contributing

Contributions are welcome—have a look at our contributing guidelines.