rootherald/rootherald
The server→server Background-Check client for PHP 8.1+. Mint a challenge, appraise the client's opaque evidence with your rh_sk_ secret key, and get the verdict back directly. Uses the curl extension directly — no Guzzle dependency.
This SDK is implemented but not yet published to its package registry. Until it ships, collect an opaque evidence blob on the device and appraise it server-side with @rootherald/node (or any available server SDK). The API shown below is the planned surface and may change before release.
How it works
Your keyless client collects an opaque evidence blob and hands it to your backend. Your backend uses Rootherald\\BackgroundCheck, authenticated with its rh_sk_ secret, to mint a nonce (issueChallenge) and submit the evidence for appraisal (verify). The verdict is computed by Root Herald and returned to your backend — it never travels through the client, which holds no key.
Install
composer require rootherald/rootheraldConstruct the client
The constructor validates the key — anything not starting with rh_sk_ is rejected.
use Rootherald\BackgroundCheck;
$rh = new BackgroundCheck(secretKey: getenv('RH_SECRET_KEY')); // rh_sk_…Mint a challenge
// Relay $challenge->nonce to your client; it quotes over it and returns an
// opaque evidence blob to your backend.
$challenge = $rh->issueChallenge();Verify the evidence
verify returns an AttestResult with a ->verdict (a Verdict enum: ALLOW, WARN, DENY) and the full ->verdictData array. Only protocol/auth/quota problems throw — a failing device does not.
use Rootherald\Verdict;
// $evidence is the opaque array your client collected, passed through verbatim.
$result = $rh->verify($evidence, $challenge->challengeId,
policy: 'rootherald:builtin:strict-hardware');
if ($result->verdict !== Verdict::ALLOW) {
http_response_code(403);
return;
}
// The full verdict is in $result->verdictData; read the stable device id.
$deviceId = $result->verdictData['device']['ueid'] ?? null;A runnable Laravel demo that calls the client from a controller ships in the SDK repo under samples/laravel-demo. Wire BackgroundCheck into your service container and call issueChallenge / verify from your route handlers.