Development

[mehmet-yoti]

Central Auth Token Support (SDK-2767) and Central Auth Token Support (SDK-2767)

Adds OAuth2-based central authentication tokens alongside the existing signed-request (PEM) authentication

What Changed

• New AuthStrategy abstraction (BearerTokenStrategy, SignedRequestStrategy, NoAuthStrategy)
• New Auth module for generating tokens via OAuth2 client_credentials grant with PS384-signed JWT
• DocScanClient and DigitalIdentityClient now support a fluent builder() pattern with two auth modes
• Full backward compatibility — existing PEM-based constructors continue to work unchanged
• New dependency: firebase/php-jwt ^6.0

Auth Modes

The two modes are mutually exclusive:

Mode	Method	Description
Token Auth (new)	withAuthenticationToken($token)	Use a pre-obtained bearer token
Signed Request (legacy)	withClientSdkId($id) + withPemFilePath($path)	Use SDK ID and PEM key pair

Usage

Generating a Token

$generator = AuthenticationTokenGenerator::builder()
    ->withSdkId('your-sdk-id')
    ->withPemFilePath('/path/to/key.pem')
    ->build();

$response = $generator->generate(['scope1', 'scope2']);
$token = $response->getAccessToken();

DocScan Client — Token Auth (new)

$client = DocScanClient::builder()
    ->withAuthenticationToken($token)
    ->build();

DocScan Client — Signed Request (existing)

$client = DocScanClient::builder()
    ->withClientSdkId('your-sdk-id')
    ->withPemFilePath('/path/to/key.pem')
    ->build();

Digital Identity Client — Token Auth (new)

$client = DigitalIdentityClient::builder()
    ->withAuthenticationToken($token)
    ->build();

Central Auth Token Support (SDK-2767)

Adds OAuth2-based central authentication tokens alongside the existing signed-request (PEM) authentication, mirroring the Java SDK's yoti-sdk-auth module.

What Changed

• New AuthStrategy abstraction (BearerTokenStrategy, SignedRequestStrategy, NoAuthStrategy)
• New Auth module for generating tokens via OAuth2 client_credentials grant with PS384-signed JWT
• DocScanClient and DigitalIdentityClient now support a fluent builder() pattern with two auth modes
• Full backward compatibility — existing PEM-based constructors continue to work unchanged
• New dependency: firebase/php-jwt ^6.0

Auth Modes

The two modes are mutually exclusive:

Mode	Method	Description
Token Auth (new)	withAuthenticationToken($token)	Use a pre-obtained bearer token
Signed Request (legacy)	withClientSdkId($id) + withPemFilePath($path)	Use SDK ID and PEM key pair

Usage

Generating a Token

$generator = AuthenticationTokenGenerator::builder()
    ->withSdkId('your-sdk-id')
    ->withPemFilePath('/path/to/key.pem')
    ->build();

$response = $generator->generate(['scope1', 'scope2']);
$token = $response->getAccessToken();

DocScan Client — Token Auth (new)

$client = DocScanClient::builder()
    ->withAuthenticationToken($token)
    ->build();

DocScan Client — Signed Request (existing)

$client = DocScanClient::builder()
    ->withClientSdkId('your-sdk-id')
    ->withPemFilePath('/path/to/key.pem')
    ->build();

Digital Identity Client — Token Auth (new)

$client = DigitalIdentityClient::builder()
    ->withAuthenticationToken($token)
    ->build();