incy/link-encoder (PHP)

PHP port of @incy/link-encoder — encode VPN subscription URLs into incy://crypt1/<payload> deep links that the INCY iOS, Android, and Desktop clients decode automatically.

Wire-compatible with the JS/Python/Go ports and the client apps; a pinned test vector guards against drift. The canonical source lives in the main repo under php/; this repository mirrors it so Packagist (which reads composer.json from the repo root) can serve it.

This is obfuscation, not security. The AES-256-GCM key is derived from constants and asset bytes embedded in this package — anyone reading the source can reconstruct it. The same key already ships in every INCY client. See the main README for the full threat model.

Install

composer require incy/link-encoder

Requires PHP ≥ 8.1 with openssl, mbstring, and json extensions.

Usage

use Incy\LinkEncoder\LinkEncoder;

$link = LinkEncoder::encryptLink('https://sub.your-provider.example/abc123token', 'My Provider VPN');
// → incy://crypt1/AAECAwQFBgcICQoLNyIQL3rDwRZqnyoD8pGK…

$decoded = LinkEncoder::decryptLink($link);
echo $decoded['url'], ' ', $decoded['name'];

API

LinkEncoder::encryptLink(string $url, ?string $name = null): string
LinkEncoder::decryptLink(string $link): array   // ['url' => string, 'name' => ?string]
LinkEncoder::encryptLinkDeterministic(string $url, string $iv, ?string $name = null): string  // tests only

LinkEncoder::VERSION
LinkEncoder::SCHEME_VERSION   // "crypt1"
LinkEncoder::KEY_FINGERPRINT  // SHA-256 of K1
LinkEncoder::schemes()        // registry of known schemes (today: crypt1)

Tests

php tests/run.php

Keeping in sync

src/Keymat.php is generated from the shared assets/*.bin in the main repo. When those bytes rotate (a new scheme), regenerate there (npm run gen-keymat) and copy the updated php/src/* here.