PHP SDK

The published package revkeen/sdk-php 1.20260819.1529 was independently installed and checked on 5 September 2026. The checks cover request path/query, API-key authentication, HTTP errors, and raw-body webhook signatures with tamper rejection. Newer source capabilities still require their own package release.

Install

composer require revkeen/sdk-php:1.20260819.1529

Use PHP 8.1+ with the package's required cURL, JSON, and mbstring extensions. See Packagist and the source mirror.

First staging request

<?php
require 'vendor/autoload.php';

use GuzzleHttp\Client;
use RevKeen\Api\CustomersApi;
use RevKeen\Configuration;

$key = getenv('REVKEEN_API_KEY');
if (!$key) throw new RuntimeException('Set a staging merchant secret key');
$config = (new Configuration())
    ->setHost('https://staging-api.revkeen.com/v2')
    ->setApiKey('x-api-key', $key);
$api = new CustomersApi(new Client(['timeout' => 10]), $config);
$customers = $api->customersList(10, 0);

This sends GET /v2/customers?limit=10&offset=0. The generated PHP client uses API classes such as CustomersApi; do not copy a TypeScript-style $client->customers->list() chain. Keep the key on your server and select the matching environment explicitly.

Errors

Catch RevKeen\ApiException to inspect the HTTP status through getCode(). Treat 401 as authentication failure, 403 as denied access, and 429 as a rate limit. Keep response/request identifiers for support and redact customer data. A failed or timed-out mutation is not proof that no money moved: reconcile before retrying.

Webhook verification

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_REVKEEN_SIGNATURE'] ?? '';
$secret = getenv('REVKEEN_WEBHOOK_SECRET');
if (!$secret) throw new RuntimeException('Set the webhook signing secret');
$event = RevKeen\Webhooks::constructEvent($payload, $signature, $secret);

Catch RevKeen\WebhookSignatureVerificationException and reject invalid signatures. Verify the exact raw bytes before decoding or performing work. Persist a merchant-scoped event ID before acknowledgement; verification alone does not prevent duplicate fulfilment. Follow receiving webhooks for durable acceptance and retry behavior.

Coverage and upgrade

This is the August package contract. The new quantities and individual-event/provenance APIs may need a newer SDK release; use REST when your installed class does not expose the operation. Review release availability before upgrading.