PHP library — Voidhash Docs

The mobile SDKs decide what to show on the device. They cannot protect anything a customer can reach by calling your API directly, such as an export endpoint or a paid model. Those checks belong on your server, and this library is how you make them.

voidhash/voidhash-php is a client for the Voidhash REST API. It authenticates every request with a project secret key.

Install the library

Install the package with Composer.

composer require voidhash/voidhash-php

The library needs PHP 8.1 or newer with the curl, json, and mbstring extensions. Every common PHP build already includes them.

Create a secret key

In Studio, open Settings → API Keys and create a secret key. The raw value is shown only once.

Store the key in an environment variable or your secret manager. A secret key grants full access to the project. Never put it in a mobile app, a web bundle, or a repository.

Create the client

Create one client with your secret key and share it across your application.

src/Voidhash.php

use Voidhash\Client;

$voidhash = new Client(getenv("VOIDHASH_SECRET_KEY"));

The constructor accepts these arguments.

Constructor argument	Default	Description
`$secretKey`	none	Required. The library sends it as the `x-secret-key` header.
`$baseUrl`	`https://api.voidhash.com`	Overrides the API origin. The scheme must be `http:` or `https:`.
`$headers`	`[]`	Extra headers the library adds to every request from this client.

The constructor validates its arguments right away rather than on the first request. It throws Voidhash\ConfigurationException when $secretKey is blank, $baseUrl is invalid, or $headers contains x-secret-key in any casing.

With the client configured, continue with checking access or receiving webhooks.

Resource methods

Each API resource is an object on the client, reached through a fluent accessor such as entitlements() or webhooks(). The example below checks a perk and then registers a webhook endpoint.

$hasPremium = $voidhash->entitlements()->hasActivePerk(
    distinctId: "user_123",
    perkSlug: "premium",
);

$endpoint = $voidhash->webhooks()->createWebhookEndpoint(
    name: "production-backend",
    url: "https://api.example.com/webhooks/voidhash",
    events: ["subscription.created", "purchase.completed"],
);

Every method returns a decoded associative array. Its shape matches the JSON response documented in the API reference exactly, so there is no response wrapper to unwrap.