Polaris for PHP · 0.1.0
Auth your users can trust, and your agents can operate.
A self-hosted authentication library for PHP: users, sessions, rotating refresh tokens, MFA, organizations and roles, in your database and your code. One core, adapters for Laravel, Symfony, Yii and any PSR-15 application, and 52 endpoints whose behaviour is frozen by 1,201 recorded request/response steps replayed through every framework in CI.
composer require polaris/laravel composer require polaris/symfony composer require polaris/yii composer require polaris/core polaris/psr15 polaris/pdo Laravel · 13
polaris/laravel
php artisan polaris:install && php artisan migrate, then Route::middleware('auth:polaris').
Symfony · 7.4 / 8
polaris/symfony
Register PolarisBundle, import the routes with type: polaris, put PolarisAuthenticator on a firewall.
Yii · 3
polaris/yii
A yiisoft/config plugin: set the polaris params, and the routes and the polaris/authentication middleware are there.
PSR-15 · Slim, Mezzio, any PSR-15 host
polaris/psr15
Polaris::create(new Config(...)), Pipeline::middleware(), Pipeline::handler().
Why Polaris
Self-hosted, in your code
Users, sessions and credentials live in your database. Every port (mailer, SMS, cache, clock, encrypter) has a working default you can replace.
Specified end to end
Every endpoint is a YAML spec that is also the router; polaris manifest --format=openapi emits OpenAPI 3.1 from it.
Proven identical everywhere
The contract fixtures replay through PSR-15, Laravel, Symfony and Yii; the adapter conformance suite runs on 3 databases.
More than your framework gives you
Rotating refresh-token families with reuse detection, step-up authentication, JWKS rotation, TOTP / SMS / email MFA with recovery codes, organizations with roles and invitations, audit log, 35 events.
Features
A complete identity stack, in your database.
Each area is specified in the documentation and implemented by
polaris/core; 184 recorded fixtures freeze
every response.
Authentication flows
Email-verified registration and login, JWT access tokens with rotating refresh tokens, password reset, and session revocation. Every flow specified, every edge case covered.
/docs/auth/flowsMFA & OTP
Three factor types out of the box: TOTP with QR enrollment, SMS, and email codes. Single-use recovery codes and step-up authentication for sensitive operations.
/docs/auth/mfa-otpOrganizations & RBAC
Multi-tenant by design: identity is global, authority is per organization. Users join organizations and carry roles scoped to each one, enforced by middleware.
/docs/auth/rbacZero-downtime key rotation
A documented runbook for rotating the JWT signing keypair with JWKS kid versioning. Old tokens keep verifying while new ones sign with the fresh key.
/docs/auth/key-rotationDomain events
PSR-14 events for every auth action: registrations, logins, failures, MFA challenges, role changes. Audit trails and side effects without forking the module.
/docs/auth/eventsSecurity & threat model
A written threat model behind every decision: hashing, token lifetimes, enumeration resistance, rate limits. Security-critical code held to an explicit, reviewable standard.
/docs/auth/securityOrigin
Polaris was built as the identity module of
Univeros and reached 1.0 there in
June 2026. In September 2026 it was extracted into the
polaris/* packages, with every response frozen by
184 recorded fixtures. Since September 2026 Univeros
hosts run univeros/polaris 2.x, the
same module rebuilt on polaris/core
(its documentation); 1.x
installations keep working on their own branch.
Get started
Install Polaris for PHP in your framework.
Laravel, Symfony, Yii or any PSR-15 application, on PostgreSQL, MySQL, SQLite.