PHP SDK
Installation
1
composer require botbye/botbye-php-sdk
Configuration
Phishing lives in its own dedicated BotbyePhishingClient, separate from the evaluate BotbyeClient. It is identified by a public, browser-safe clientKey, so it needs no server key — it only needs a PSR-18 HTTP client and a PSR-17 request factory. On first use it makes a one-off, process-wide-guarded, best-effort server-integration init handshake that reports this server-side integration to BotBye; it is non-blocking.
BotbyePhishingConfig takes 2 values: endpoint (optional, defaults to https://verify.botbye.com) and clientKey.
Getting clientKey
clientKey is the public, browser-safe identifier of your phishing project. It travels in the asset URL path, so it is safe to expose — no secret token and no Base64 encoding are required.
Find it on the Get Started screen of your phishing project in the BotBye dashboard.
1
2
3
4
5
6
7
8
9
10
11
use Botbye\Phishing\BotbyePhishingClient;
use Botbye\Phishing\BotbyePhishingConfig;
$phishing = new BotbyePhishingClient(
new BotbyePhishingConfig(
endpoint: 'https://verify.botbye.com',
clientKey: '<public-client-key>',
),
$httpClient, // PSR-18 ClientInterface
$requestFactory, // PSR-17 RequestFactoryInterface
);
Usage
Expose a single endpoint that proxies phishing pixel requests.
When you use an SVG image, your application must also expose an endpoint on the client origin that handles requests to /{imageId}.png, where imageId is the value that arrives in the forwarded pixel query as image_id.
1
2
3
4
5
6
7
8
9
10
11
12
$origin = $_SERVER['HTTP_ORIGIN'] ?? null;
$res = $phishing->fetchImage(origin: $origin, query: $_GET);
if ($res->error !== null) {
http_response_code(502);
echo $res->error->message;
exit;
}
http_response_code($res->status);
header('Content-Type: ' . ($res->headers['Content-Type'] ?? 'image/png'));
echo $res->body;
Settings
Configuration parameters for phishing integration:
| Setting | Description | Required | Default Value |
|---|---|---|---|
| endpoint | Host of the phishing API | no | https://verify.botbye.com |
| clientKey | Public client-key of your phishing project | yes | - |