PHP SDK

ekoindia/eps-sdk is a client for every EPS API that needs nothing beyond ext-curl and ext-json. One generic call($slug, $params) covers all of them: the endpoint catalog, each endpoint's params and which of them are required are baked into the package from the same surface these docs are built from, so the client validates your input before it signs and sends anything.

Install

composer require ekoindia/eps-sdk

Your first call

Read the two keys from your secret store, pick an environment, and call an endpoint by its slug:

<?php
use Eko\Eps\EpsClient;

$client = new EpsClient(
    developerKey: getenv('EPS_DEVELOPER_KEY'),
    accessKey: getenv('EPS_ACCESS_KEY'),
    initiatorId: '9962981729',
    environment: 'sandbox'
);

$result = $client->call('pan-lite', [
    'pan_number' => 'ABCDE1234F',
    'name' => 'Rajesh Kumar',
    'dob' => '1994-08-29'
]);
print_r($result);

Use named arguments — the constructor takes six parameters and only the first three are required. $initiatorId and $userCode are near-constant per developer, so set them once on the client. They are injected into every call as the wire params initiator_id and user_code (note the snake_case wire names) — pass either in $params to override it for a single call.

Client options

API surface

The SDK is deliberately small. There is no method per endpoint — call() takes the slug, and the baked surface supplies the method, path, and validation rules. resolveTarget(), curlOptions() and the static decodeResponse() are the three seams the conformance tests drive, and they are just as useful for debugging a request without sending it.

Authentication

You never compute a signature yourself. On every request the client derives secret-key = base64(HMAC-SHA256(timestamp, base64($accessKey))) and sends it with secret-key-timestamp and developer_key. EpsClient::signSecretKey() is public only so you can reproduce a signature while debugging a 403.

File uploads

A single type: "file" param flips the whole request to multipart/form-data. You still pass every parameter flat; on the wire the SDK packs them the way the API expects — one form field named form-data holding all the non-file params as a single JSON object, plus one part per upload. A null param is dropped (a form field has no null encoding), while a null nested inside an array value is preserved.

File params accept:

• A local file path (wrapped in a CURLFile for you)
• A \CURLFile you built yourself

Errors and timeouts

A non-2xx response throws — an auth or infrastructure failure is never returned as if it were a result. The decoded envelope is still on the exception, so you can read status and message off ->body.

Environments

Switch with the $environment argument; there is no base-URL override.

PHP-specific notes

• Presence is checked with isset(), so a param explicitly set to null counts as missing — matching every other SDK.

Every endpoint

call() accepts every slug in the EPS catalog. Each endpoint's reference page shows its parameters, response fields and a ready-to-paste PHP snippet.