An API development kit for PHP

Everything for the road.
Nothing you don't need.

Kipchak gives your PHP API the structure of a framework without the weight of one — Slim 4 underneath, FrankenPHP worker mode in front, and 29 drivers and middleware ready when you are.

Start building Read the documentation

Five minutes to first request

$ composer create-project kipchak/starter my-api
$ docker compose up --watch

✓ FrankenPHP worker running
✓ http://localhost/status → 200 OK

3,000^req/s

served in production on the AlAdhan API, per instance

60^{% less}

resource use than comparable Laravel or Symfony stacks on FPM

29^packages

independent drivers & middleware — adopt them one at a time

0^magic

PSR-compliant throughout — it's Slim, structured

A framework's structure, a library's footprint

Kipchak is a handful of files on top of Slim. It formalises the three things every API needs — booting, drivers, middleware — and stays out of everything else.

§1

One honest bootstrap

Api::boot() loads drivers, middleware, then routes. You can read the whole core in a sitting.

§2

Nothing to unlearn

PSR-3, 7, 11 and 18 throughout. If you know modern PHP, you already know Kipchak.

§3

Worker-mode native

Long-lived FrankenPHP processes with Caddy in front — and hot reload while you develop.

§4

Configuration first

Plain PHP config files, one per concern: kipchak.doctrine.php, kipchak.valkey.php — env-aware and greppable.

§5

Container-ready

Docker and Kubernetes configuration ship in the starter. Dev and production run the same image.

§6

Extensible by design

Drivers implement a three-method interface. Your team's internal services become drivers in an afternoon.

The caravan: drivers & middleware

Each one an independent Composer package following the same conventions. Free packages are open source; Enterprise packages fund the project and come with support.

Drivers · 20 packages · 12 planned

ConfigLoads all configuration files — always initialised firstFree LoggerPSR-3 loggingFree HTTPPSR-18 HTTP clientFree MemcachedDistributed memory cacheFree FilecacheFile-based cacheFree DoctrineRelational databases via Doctrine ORMFree CouchDBCouchDB document storageFree RabbitMQQueues & messaging over RabbitMQFree GitGit repository operationsFree Object Storage (S3)S3-compatible object storageFree OpenAIOpenAI client with per-connection model defaultsFree AnthropicAnthropic Claude client, multi-connectionFree Cloudflare DNSCloudflare zones & records, fully typedFree ClouDNSClouDNS management with GeoDNS supportFree ClamAVAntivirus scanning via clamdFree OAuth 2 TokenOAuth 2.0 client-credentials token handlingEnterprise

ValkeyValkey / Redis cache — standalone, sentinel, cluster & replicaEnterprise OpenSearchOpenSearch, multi-connection with every auth modeEnterprise KafkaKafka producer & consumer with SASL/SSLEnterprise OPAPolicy decisions via Open Policy AgentEnterprise

Vault / OpenBaoSecrets, dynamic credentials & rotationPlannedEnterprise

LDAP / Active DirectoryDirectory authentication & lookupsPlannedEnterprise

ClickHouseColumnar analytics at scalePlannedFree

NATS JetStreamLightweight cloud-native messagingPlannedFree

Cassandra / ScyllaDBWide-column storage at scalePlannedEnterprise

Snowflake / BigQueryData-warehouse queriesPlannedEnterprise

Vector DatabaseRAG-ready vector search (Qdrant, pgvector & more)PlannedFree

SOAP ClientTyped clients for legacy SOAP servicesPlannedEnterprise

IBM MQEnterprise message queueingPlannedEnterprise

SFTPBatch B2B file exchangePlannedFree

TemporalStart, signal & query durable workflowsPlannedFree

Feature FlagsUnleash / Flagsmith flag evaluationPlannedFree

Middleware · 9 packages · 8 planned

Error HandlingStructured error responsesFree Subashi WAFWeb application firewallFree Auth — JWKSJWKS-based authenticationFree Auth — API KeysAPI key authenticationFree Auth — Request SigningHMAC-signed requests & webhooks with replay protectionFree Auth — JWTAdvanced JWT authenticationEnterprise Subashi ProEnterprise WAF with geo & ASN edge intelligenceEnterprise Usage MeteringPer-consumer usage events for billing, to Kafka or logsEnterprise QuotasPer-plan limits on requests and credits, per customerEnterprise

OpenTelemetryOTLP traces & metrics, auto-instrumented driversPlannedFree

Audit LogImmutable request audit trailsPlannedEnterprise

RBAC / ABAC PolicyRoute-level authorisation on JWT claimsPlannedEnterprise

PII RedactionMask sensitive fields in responses & logsPlannedEnterprise

IdempotencyIdempotency-Key replay protectionPlannedEnterprise

Circuit BreakerFleet-wide breakers for downstream callsPlannedEnterprise

Response CacheRFC-compliant HTTP cachingPlannedFree

Multi-TenancyTenant resolution & scoped servicesPlannedEnterprise

Kipchak Enterprise

For the teams who can't go down

The infrastructure-grade tier: clustering, search and streaming drivers, edge intelligence, and advanced auth — supported by the people who wrote them.

OAuth 2 Token

OAuth 2.0 client-credentials token handling

Valkey

Valkey / Redis cache — standalone, sentinel, cluster & replica

OpenSearch

OpenSearch, multi-connection with every auth mode

Kafka

Kafka producer & consumer with SASL/SSL

OPA

Policy decisions via Open Policy Agent

Auth — JWT

Advanced JWT authentication

Subashi Pro

Enterprise WAF with geo & ASN edge intelligence

Usage Metering

Per-consumer usage events for billing, to Kafka or logs

Quotas

Per-plan limits on requests and credits, per customer

Priority support

Upgrade guidance from the maintainers

Talk to the team

Proven on the road

“The AlAdhan API answers three thousand requests a second for the global Muslim community — on Kipchak, on far less hardware than before.”

aladhan.com · Islamic Network · AlAdhan API, running on Kipchak v3

Relative resource use · same workload

Kipchak + FrankenPHP	1.0×
Slim + FPM	~1.6×
Laravel / Symfony + FPM	~2.5×

Measured on production API workloads at Mamluk; your numbers will vary.

Everything for the road.Nothing you don't need.