PHP SDK - Configuration

NexusConfig is a constructor-promoted value object holding every setting required to build a client. Pass it to NexusClient::create.

use WestyxNexus\NexusClient;
use WestyxNexus\NexusConfig;

$client = NexusClient::create(new NexusConfig(
    baseUrl: 'https://<slug>.westyx.dev', // required
    apiKey:  'wxs_...',               // required unless using WIF
    ttl:     60,                          // optional, default 60 seconds
    logger:  $myLogger,                   // optional PSR-3 LoggerInterface
));

Field reference

Field	Type	Default	Description
`baseUrl`	`string`	-	Full service URL, e.g. `https://<slug>.westyx.dev`. The slug in the host is also sent as the `Host` header on every request (Double-Gate requirement).
`apiKey`	`string`	`''`	Raw `wxs_...` or `wxp_...` key. Sent in `X-Nexus-API-Key`. Optional when `wif` is set.
`ttl`	`int`	`60`	Local cache TTL in seconds. The first read after it elapses triggers one sync. `0` re-syncs on every read; a negative value is rejected.
`logger`	`?LoggerInterface`	`null`	PSR-3 logger. `null` suppresses all SDK log output. See Custom logging.
`wif`	`?WifConfig`	`null`	Optional Workload Identity Federation config. When non-null, the SDK exchanges a workload OIDC token for a Nexus session JWT and uses `Authorization: Bearer`. See Workload identity.
`sseReconnectCooldown`	`int\|array\|null`	`null`	Schedule for reconnecting SSE after falling back to TTL polling. Unit: minutes. `null` = `[5, 10, 20, 40, 60]`. `int` = a fixed delay. `array` = a schedule whose last entry repeats.
`sseConnectTimeout`	`int`	`10`	Seconds allowed to establish an SSE connection.
`sseIdleTimeout`	`int`	`60`	Seconds allowed between bytes on a live SSE stream. Every byte resets it, keepalive comments included.

Validation

Every option is resolved and validated when NexusConfig is constructed, and an invalid one is rejected naming the option, the value, and - for the reconnect schedule - the array index:

Rejected	Why
a non-`https` `baseUrl` (loopback excepted)	credentials travel on every request
`ttl` below `0`	no meaningful reading
`sseReconnectCooldown` of `0`, a negative number, `[]`, or a non-int entry	a zero cooldown is a reconnect storm; an empty schedule has nothing to select from
`sseConnectTimeout` or `sseIdleTimeout` below `1`	a zero deadline fires immediately

Coercing a bad value into a working one hides the mistake: it resurfaces days later as unexplained load or a stalled stream, with nothing pointing at the cause. An unusable value is rejected at construction, naming the option, the value and the array index, rather than being adjusted to something that works.

API key types

Prefix	Access
`wxs_...`	Full - all configs, all secrets, all flags. Write API (`setSecret`, `deleteSecret`, `deleteSecretVersion`) available.
`wxp_...`	Restricted - configs and flags only. `getSecret` throws `NexusPublicKeyException` synchronously.

Calling getSecret(...) or getSecretFilePath(...) with a public key throws NexusPublicKeyException before any network call is made.

Where to keep the API key

Use environment variables - never hardcode the key in source:

$client = NexusClient::create(new NexusConfig(
    baseUrl: (string) getenv('NEXUS_URL'),
    apiKey:  (string) getenv('NEXUS_API_KEY'),
));

In Laravel or Symfony, use the application’s config system:

// Laravel - config/services.php
'nexus' => [
    'url' => env('NEXUS_URL'),
    'key' => env('NEXUS_API_KEY'),
],

The SDK never logs the raw key. Log lines reference the key type only:

[nexus] Client ready. key_type=sk ttl=60s

Choosing the TTL

The TTL controls how long the in-memory cache is considered fresh before a background sync is triggered. With SSE enabled (connectStream()), changes propagate within milliseconds regardless of the TTL - the TTL only matters as a fallback when the stream is not running (FPM request handlers, for example).

Use case	Suggested TTL
FPM request handler (cache is per-request anyway)	`60` (default)
Frequently-changing flags, latency-sensitive daemon	`30`
Standard configs with SSE daemon	`60` (default)
Stable production secrets	`300`
Boot-time only, never rechecked	`3600`

In PHP-FPM, each request creates a fresh PHP process, so the cache is always empty at the start of a request and the TTL has no staleness effect across requests. The TTL is relevant only for long-running CLI daemons and queue workers.

Custom HTTP client

The factory accepts a PSR-18 client as its second argument, so the stack your application already configures - its timeouts, CA bundle, proxy, middleware and instrumentation - is what talks to Nexus:

use GuzzleHttp\Client as GuzzleClient;

$http = new GuzzleClient([
    'timeout' => 10.0,
    'verify'  => '/path/to/ca-bundle.crt',
    'proxy'   => 'http://proxy.internal:3128',
]);

$client = NexusClient::create(new NexusConfig(
    baseUrl: $_ENV['NEXUS_URL'],
    apiKey:  $_ENV['NEXUS_API_KEY'],
), $http);

Any PSR-18 implementation works - Guzzle above, Symfony HttpClient, or your own. Pass nothing and the SDK discovers whichever one the project has installed. See HTTP client.

Do not set a timeout that is too short - the initial sync is blocking and must complete before create returns. 10 seconds is a sensible minimum.

WifConfig overview

When you pass a WifConfig to NexusConfig::$wif, the SDK skips the static apiKey on every request and instead exchanges a workload OIDC token for a Nexus session JWT:

use WestyxNexus\NexusConfig;
use WestyxNexus\WifConfig;

$client = NexusClient::create(new NexusConfig(
    baseUrl: $_ENV['NEXUS_URL'],
    wif: new WifConfig(provider: WifProvider::AUTO),
));

See Workload identity for the full provider table, the WifCredentialSource extension point, and token exchange details.

Overview

Backend SDKs

Browser SDKs

OpenFeature Providers

PHP SDK - Configuration

Field reference

Validation

API key types

Where to keep the API key

Choosing the TTL

Custom HTTP client

WifConfig overview

​Field reference

​Validation

​API key types

​Where to keep the API key

​Choosing the TTL

​Custom HTTP client

​WifConfig overview

Field reference

Validation

API key types

Where to keep the API key

Choosing the TTL

Custom HTTP client

WifConfig overview