M7 Identity is open for development use
M7 Identity is available to try. Not as a sales call. As a live authorization server, public docs, and checksummed PHP packages.
Until now the honest sentence was: the IdP is real, integration is M7-aware, talk to us. That sentence is done. You can create a development account, register an application, put Sign in with M7 on a PHP site, and validate a token.
Launch availability
At this launch, development access was free. Accounts created then were intended to remain. APIs, formats, and limits could still change. Billing was paused.
The PHP SDK versions available at this launch:
| Package | Version | Role |
|---|---|---|
| Web/PHP | 0.1.3 | Browser/BFF session at /m7_sso_session |
| Token/PHP | 0.1.2 | Validate tokens, acquire, refresh, ACK, UserInfo |
| CLI/PHP | 0.1.1 | m7-identity over the token package |
Download from the Identity SDK docs. Verify each ZIP against its SHA-256 sidecar before you unpack it. Packagist is not available. The license is MTL-10, not MIT.
Start here:
The issuer to configure is https://sso.user.m7.org. PKCE is S256 only. Stock OIDC refresh works without M7 binding fields. Signed UserInfo is available when you register it. Client IDs, tenants, and secrets stay behind login. The library is public.
Integration update, 2 October 2026: The table above records the launch versions. Use the current SDK documentation and downloads for present installation choices, and the PHP full-page walkthrough or hosted PHP page integration for the two starting paths.
The current provider profile supports tls_client_auth and self_signed_tls_client_auth. Certificate authentication is separate from opting into certificate-bound tokens with tls_client_certificate_bound_access_tokens=true; those tokens require the exact bound certificate on refresh and protected-resource requests over mutual TLS. This updates the original launch limitation without asserting that every integration supports that profile.
What this is not
This is not GA. It is not OpenID certified. It is not a drop-in for every unmodified relying party. It is not composer require. It is not a shared user pool.
M7 keeps people, machines, and tenants as different principals. Use the stock OAuth/OIDC path when that is enough. Use DPoP, ACK, and bindings when you want the M7 path.
Contact is for commercial work, custom integration, and larger-team licensing. It is not the only door.
If you build software and want identity you can actually install, start with the SDK.