Laravel
Installation
1
composer require botbye/botbye-php-sdk
Configuration
Register the standalone BotbyePhishingClient in your AppServiceProvider. Phishing is separate from the evaluate BotbyeClient, is identified by a public, browser-safe clientKey, and only needs a PSR-18 HTTP client and a PSR-17 request factory (no server key, no stream factory). Registered as a singleton, on first use it makes a one-off, process-wide-guarded, best-effort server-integration init handshake that reports this server-side integration to BotBye; it is non-blocking.
Getting clientKey
clientKey is the public, browser-safe identifier of your phishing project. It travels in the asset URL path, so it is safe to expose — no secret token and no Base64 encoding are required.
Find it on the Get Started screen of your phishing project in the BotBye dashboard.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
<?php
namespace App\Providers;
use Botbye\Phishing\BotbyePhishingClient;
use Botbye\Phishing\BotbyePhishingConfig;
use GuzzleHttp\Client;
use GuzzleHttp\Psr7\HttpFactory;
use Illuminate\Support\ServiceProvider;
class AppServiceProvider extends ServiceProvider
{
public function register(): void
{
$this->app->singleton(BotbyePhishingClient::class, function () {
$httpClient = new Client(['timeout' => 2.0]);
$factory = new HttpFactory();
return new BotbyePhishingClient(
new BotbyePhishingConfig(
endpoint: 'https://verify.botbye.com',
clientKey: '<public-client-key>',
),
httpClient: $httpClient,
requestFactory: $factory,
);
});
}
}
Usage
Expose a single route that proxies phishing pixel requests.
When you use an SVG image, your application must also expose an endpoint on the client origin that handles requests to /{imageId}.png, where imageId is the value that arrives in the forwarded pixel query as image_id.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
use Botbye\Phishing\BotbyePhishingClient;
use Illuminate\Support\Facades\Route;
Route::get('/api/phishing/image', function (BotbyePhishingClient $phishing) {
$origin = request()->header('Origin');
$res = $phishing->fetchImageFromRequest(request(), request()->query());
if ($res->error !== null) {
return response($res->error->message, 502);
}
$contentType = $res->headers['Content-Type'] ?? 'image/png';
return response($res->body, $res->status)
->header('Content-Type', $contentType);
});
Settings
Configuration parameters for phishing integration:
| Setting | Description | Required | Default Value |
|---|---|---|---|
| endpoint | Host of the phishing API | no | https://verify.botbye.com |
| clientKey | Public client-key of your phishing project | yes | - |