Polaris for PHP · 0.11.0
Auth your users can trust, and your agents can operate.
A self-hosted authentication library for PHP: users, sessions, rotating refresh tokens, MFA, organizations and roles, in your database and your code. One core, adapters for Laravel, Symfony, Yii and any PSR-15 application, and 52 endpoints whose behaviour is frozen by 1,201 recorded request/response steps replayed through every framework in CI. 16 plugins add passkeys, social and passwordless sign-in, API keys, an OAuth 2.1 provider, SSO and SCIM, MCP, and AI agents as principals.
composer require polaris/laravel composer require polaris/symfony composer require polaris/yii composer require polaris/core polaris/psr15 polaris/pdo Laravel · 13
polaris/laravel
php artisan polaris:install && php artisan migrate, then Route::middleware('auth:polaris').
Symfony · 7.4 / 8
polaris/symfony
Register PolarisBundle, import the routes with type: polaris, put PolarisAuthenticator on a firewall.
Yii · 3
polaris/yii
A yiisoft/config plugin: set the polaris params, and the routes and the polaris/authentication middleware are there.
PSR-15 · Slim, Mezzio, any PSR-15 host
polaris/psr15
Polaris::create(new Config(...)), Pipeline::middleware(), Pipeline::handler().
Why Polaris
Self-hosted, in your code
Users, sessions and credentials live in your database. Every port (mailer, SMS, cache, clock, encrypter) has a working default you can replace.
Specified end to end
Every endpoint is a YAML spec that is also the router; polaris manifest --format=openapi emits OpenAPI 3.1 from it.
Proven identical everywhere
The contract fixtures replay through PSR-15, Laravel, Symfony and Yii; the adapter conformance suite runs on 3 databases.
More than your framework gives you
Rotating refresh-token families with reuse detection, step-up authentication, JWKS rotation, TOTP / SMS / email MFA with recovery codes, organizations with roles and invitations, audit log, 35 events.
Features
A complete identity stack, in your database.
Each area is specified in the documentation and implemented by
polaris/core or one of its 16 plugins;
184 recorded fixtures freeze every core response. Coming from Better Auth?
Every Better Auth plugin, mapped to Polaris.
Authentication flows
Email-verified registration and login, JWT access tokens with rotating refresh tokens, password reset, and session revocation. Every flow specified, every edge case covered.
/docs/auth/flowsMFA & OTP
Three factor types out of the box: TOTP with QR enrollment, SMS, and email codes. Single-use recovery codes and step-up authentication for sensitive operations.
/docs/auth/mfa-otpOrganizations & RBAC
Multi-tenant by design: identity is global, authority is per organization. Users join organizations and carry roles scoped to each one, enforced by middleware.
/docs/auth/rbacZero-downtime key rotation
A documented runbook for rotating the JWT signing keypair with JWKS kid versioning. Old tokens keep verifying while new ones sign with the fresh key.
/docs/auth/key-rotationDomain events
PSR-14 events for every auth action: registrations, logins, failures, MFA challenges, role changes. Audit trails and side effects without forking the module.
/docs/auth/eventsSecurity & threat model
A written threat model behind every decision: hashing, token lifetimes, enumeration resistance, rate limits. Security-critical code held to an explicit, reviewable standard.
/docs/auth/securityPasskeys, social & passwordless
WebAuthn passkeys that double as an MFA factor, sign-in through Google, Apple, GitHub and any OAuth 2 server, magic links and one-time codes, usernames, guest sessions, several accounts per device.
/php#pluginsOAuth 2.1 provider & API keys
Polaris as an OAuth 2.1 / OpenID Connect provider with PKCE, the device flow, CIBA, token exchange and DPoP, where scopes are permissions. API keys scoped to a subset of their owner's permissions.
/docs/plugins/oauth-providerMCP & AI agents
Protect any PHP MCP server with Polaris tokens, or call Polaris itself as one. Agents are principals: capability grants with budgets, approvals, signed receipt chains and a kill switch.
/docs/plugins/agentsOrigin
Polaris was built as the identity module of
Univeros and reached 1.0 there in
June 2026. In October 2026 it was extracted into the
polaris/* packages, with every response frozen by
184 recorded fixtures. Since September 2026 Univeros
hosts run univeros/polaris 2.x, the
same module rebuilt on polaris/core with every
polaris/* plugin, async messaging through Univeros Messaging
and its section of the AgentSpec manifests
(its documentation); 1.x
installations keep working on their own branch.
Version 0.11.0
Polaris for PHP is 0.11. The code is the module that reached 1.0 in Univeros,
contract-frozen, and univeros/polaris 2.x runs on its 0.11 line; the 0.x number means the package
boundaries may still move before the external security review, after which 1.0.0 is tagged.
Roadmap · Security
Get started
Install Polaris for PHP in your framework.
Laravel, Symfony, Yii or any PSR-15 application, on PostgreSQL, MySQL, SQLite.