keboola/encryption-api-php-client

Keboola Encryption API Client

1.0.0 2026-06-19 09:41 UTC

Requires

• php: ^8.2
• guzzlehttp/guzzle: ^7.8
• keboola/php-api-client-base: ^1.0.1
• psr/log: ^1.0|^2.0|^3.0
• webmozart/assert: ^1.11

Requires (Dev)

• keboola/coding-standard: ^15.0
• phpstan/phpstan: ^1.10
• phpstan/phpstan-phpunit: ^1.3
• phpstan/phpstan-webmozart-assert: ^1.2
• phpunit/phpunit: ^9.5
• sempro/phpunit-pretty-print: ^1.4

MIT

• Keboola

README

Installation

composer require keboola/encryption-api-php-client

Development

Run the tests:

docker compose run dev composer install
docker compose run dev

Usage

Both clients build on keboola/php-api-client-base. The constructor takes the API base URL and the auth token first, followed by optional, named transport options (logger, backoffMaxTries, connectTimeout, requestTimeout, userAgent, requestHandler).

Encryption

use Keboola\EncryptionApiClient\Encryption;

$encryption = new Encryption(
    'https://encryption.keboola.com',
    getenv('STORAGE_API_TOKEN'),
);

$cipher = $encryption->encryptPlainTextForConfiguration(
    'my secret value',
    'project-id',
    'keboola.data-apps',
    '123456',
);

Migrations

use Keboola\EncryptionApiClient\Migrations;

$migrations = new Migrations(
    'https://encryption.keboola.com',
    getenv('MANAGE_API_TOKEN'),
);

$result = $migrations->migrateConfiguration(
    sourceStorageApiToken: '...',
    destinationStack: 'connection.europe-west3.gcp.keboola.com',
    destinationStorageApiToken: '...',
    componentId: 'keboola.data-apps',
    configId: '123456',
    branchId: '102',
    dryRun: true,
);

The manage token is optional. When it is omitted (or null), Migrations authenticates with the projected Connection service-account token instead — useful for in-cluster service-to-service calls:

$migrations = new Migrations('https://encryption.keboola.com'); // service-account auth

On a failed request both clients throw Keboola\EncryptionApiClient\Exception\ClientException (a subclass of Keboola\ApiClientBase\Exception\ClientException). The exception exposes getStatusCode() and getResponseBody() for the failing response, when available.

License

MIT licensed, see LICENSE file.