Skip to content
identvia Developers

Get started

Quickstart

Add “Sign in with Identvia” to a PHP site in about ten minutes. You need PHP 8.1+ with OpenSSL, which every cPanel host has.

1. Register your app

Open the developer console, sign in with your Identvia account and press New app. Choose Server-side (confidential) and add your callback URL as a redirect URI, for example http://localhost:8000/callback.php.

You’ll see the client ID and a client secret. Copy the secret straight away: it is only shown once and Identvia stores just a hash of it.

Your first environment is Development, which allows http://localhost. When you go live, add a Production environment with your real https:// callback. It gets its own client ID and secret.

2. Install the SDK

With Composer:

Terminal
composer require identvia/identvia-php

No Composer or SSH? Download the zip, which includes vendor/, unzip it next to your site in cPanel’s File Manager and require 'identvia-php/vendor/autoload.php'.

3. Configure it

identvia.phpPHP
<?php // identvia.php: include this from your login and callback pages
require __DIR__ . '/vendor/autoload.php';

session_start();

$identvia = new Identvia\Sdk\Identvia([
    'issuer'        => 'https://id.identvia.com',
    'client_id'     => getenv('IDENTVIA_CLIENT_ID'),
    'client_secret' => getenv('IDENTVIA_CLIENT_SECRET'),
    'redirect_uri'  => 'http://localhost:8000/callback.php',
    'scopes'        => ['email', 'profile'],
]);

4. Add the button

index.htmlHTML
<a class="identvia-btn" href="/login.php">Sign in with Identvia</a>
<script src="https://id.identvia.com/sdk/v1/button.js" async></script>
Sign in with Identvia← this is what it looks like

5. Start sign-in

login.phpPHP
<?php // login.php
require __DIR__ . '/identvia.php';

$identvia->redirectToSignIn(['return_to' => '/dashboard.php']);

6. Handle the callback

callback.phpPHP
<?php // callback.php
require __DIR__ . '/identvia.php';

try {
    $signIn = $identvia->handleCallback($_GET);
} catch (Identvia\Sdk\Exception\AuthorizationException $e) {
    exit($e->userCancelled() ? 'You cancelled sign-in.' : 'Sign-in failed.');
} catch (Identvia\Sdk\Exception\IdentviaException $e) {
    error_log($e->getMessage());
    exit('Sign-in failed. Please try again.');
}

session_regenerate_id(true);
$_SESSION['user_id'] = $signIn->sub();   // stable, unique to your app
$_SESSION['email']   = $signIn->email(); // only if the user shared it

header('Location: ' . ($signIn->returnTo ?? '/'));

That’s it. handleCallback() checks the state, exchanges the code with PKCE, verifies the ID token’s signature against Identvia’s keys, and checks the issuer, audience, expiry and nonce. If anything is off, it throws and nobody is signed in.

Use sub() as the user’s ID, not the email address. Users can change their email or choose not to share it, and the sub is different for every app, by design.

Next steps