# Kipchak

> Lightweight, high-performance API development kit for PHP. Built on Slim Framework, optimized for FrankenPHP workers, and ready to run on Kubernetes.

Kipchak is an API Development Kit for PHP built by Mamluk LLC-FZ (Dubai, UAE).
It adds a formal structure — bootstrapping, drivers, middleware, configuration —
on top of Slim Framework 4, and is optimised for FrankenPHP in worker mode.
Free packages are MIT-licensed; Enterprise packages are proprietary and fund
the project.

## Main pages

- [Home](https://kipchak.dev/): product overview, benchmarks, and quick start
- [Ecosystem](https://kipchak.dev/ecosystem): all drivers and middleware, shipped and planned
- [Enterprise](https://kipchak.dev/enterprise): enterprise packages, support, and managed infrastructure

## Drivers

- [Config](https://kipchak.dev/docs/driver-config) (free): Loads all configuration files — always initialised first
- [Logger](https://kipchak.dev/docs/driver-logger) (free): PSR-3 logging
- [HTTP](https://kipchak.dev/docs/driver-http) (free): PSR-18 HTTP client
- [Memcached](https://kipchak.dev/docs/driver-memcached) (free): Distributed memory cache
- [Filecache](https://kipchak.dev/docs/driver-filecache) (free): File-based cache
- [Doctrine](https://kipchak.dev/docs/driver-doctrine) (free): Relational databases via Doctrine ORM
- [CouchDB](https://kipchak.dev/docs/driver-couchdb) (free): CouchDB document storage
- [RabbitMQ](https://kipchak.dev/docs/driver-rabbitmq) (free): Queues & messaging over RabbitMQ
- [Git](https://kipchak.dev/docs/driver-git) (free): Git repository operations
- [Object Storage (S3)](https://kipchak.dev/docs/driver-object-storage) (free): S3-compatible object storage
- [OpenAI](https://kipchak.dev/docs/driver-openai) (free): OpenAI client with per-connection model defaults
- [Anthropic](https://kipchak.dev/docs/driver-anthropic) (free): Anthropic Claude client, multi-connection
- [Cloudflare DNS](https://kipchak.dev/docs/driver-cloudflare-dns) (free): Cloudflare zones & records, fully typed
- [ClouDNS](https://kipchak.dev/docs/driver-cloudns) (free): ClouDNS management with GeoDNS support
- [ClamAV](https://kipchak.dev/docs/driver-clamav) (free): Antivirus scanning via clamd
- [SFTP](https://kipchak.dev/docs/driver-sftp) (free): Batch file exchange with partners over SFTP
- [Feature Flags](https://kipchak.dev/docs/driver-feature-flags) (free): Feature flags from Unleash, Flagsmith or GrowthBook
- [ClickHouse](https://kipchak.dev/docs/driver-clickhouse) (free): Analytics queries, streamed results and batched inserts
- [Vector Databases](https://kipchak.dev/docs/driver-vector) (free): Semantic search and RAG on Qdrant, pgvector or OpenSearch
- [NATS & JetStream](https://kipchak.dev/docs/driver-nats) (free): Messaging, request/reply, durable streams and key-value buckets
- [OAuth 2 Token](https://kipchak.dev/docs/driver-oauth2-token) (enterprise): OAuth 2.0 client-credentials token handling
- [Valkey](https://kipchak.dev/docs/driver-valkey) (enterprise): Valkey / Redis cache — standalone, sentinel, cluster & replica
- [OpenSearch](https://kipchak.dev/docs/driver-opensearch) (enterprise): OpenSearch, multi-connection with every auth mode
- [Kafka](https://kipchak.dev/docs/driver-kafka) (enterprise): Kafka producer & consumer with SASL/SSL
- [OPA](https://kipchak.dev/docs/driver-opa) (enterprise): Policy decisions via Open Policy Agent
- [LDAP](https://kipchak.dev/docs/driver-ldap) (enterprise): LDAP & Active Directory logins, groups and search
- [Vault / OpenBao](https://kipchak.dev/docs/driver-vault) (enterprise): Secrets from Vault or OpenBao in config, with KV and Transit
- [OpenTelemetry](https://kipchak.dev/docs/driver-opentelemetry) (enterprise): Traces, metrics and logs over OTLP, with the drivers instrumented

## Middleware

- [Error Handling](https://kipchak.dev/docs/mw-error) (free): Structured error responses
- [Subashi WAF](https://kipchak.dev/docs/mw-subashi) (free): Web application firewall
- [Response Cache](https://kipchak.dev/docs/mw-response-cache) (free): HTTP caching with ETags, 304s and invalidation
- [Feature Flags](https://kipchak.dev/docs/mw-feature-flags) (free): Gate routes on flags, with rollouts sticky per API key
- [Auth — JWKS](https://kipchak.dev/docs/mw-auth-jwks) (free): JWKS-based authentication
- [Auth — API Keys](https://kipchak.dev/docs/mw-auth-key) (free): API key authentication
- [Auth — Request Signing](https://kipchak.dev/docs/mw-auth-hmac) (free): HMAC-signed requests & webhooks with replay protection
- [Auth — JWT](https://kipchak.dev/docs/mw-auth-jwt) (enterprise): Advanced JWT authentication
- [Subashi Pro](https://kipchak.dev/docs/mw-subashi-pro) (enterprise): Enterprise WAF with geo & ASN edge intelligence
- [Usage Metering](https://kipchak.dev/docs/mw-metering) (enterprise): Per-consumer usage events for billing, to Kafka or logs
- [Quotas](https://kipchak.dev/docs/mw-quotas) (enterprise): Per-plan limits on requests and credits, per customer
- [Idempotency](https://kipchak.dev/docs/mw-idempotency) (enterprise): Safe retries with Idempotency-Key: responses replayed, never run twice
- [PII Redaction](https://kipchak.dev/docs/mw-redaction) (enterprise): Mask, hash or remove personal data in responses and every log line
- [Audit Log](https://kipchak.dev/docs/mw-audit) (enterprise): Signed records of who did what, to Kafka, OpenSearch or NATS
- [RBAC / ABAC Policy](https://kipchak.dev/docs/mw-policy) (enterprise): Route-level authorisation from roles, permissions, attributes or OPA
- [Circuit Breaker](https://kipchak.dev/docs/mw-circuit-breaker) (enterprise): Fleet-wide breakers for downstream calls, shared in Valkey
- [OpenTelemetry](https://kipchak.dev/docs/mw-opentelemetry) (enterprise): A server span and request metrics for every request

## Documentation

- [A Brief History of Kipchak](https://kipchak.dev/docs/history): A Brief History of the Kipchak API Development Toolkit
- [API Key Middleware](https://kipchak.dev/docs/mw-auth-key): Add API Key Authentication to your Kipchak API.
- [Anthropic Driver](https://kipchak.dev/docs/driver-anthropic): Use Claude models in Kipchak via the official Anthropic PHP SDK, with multiple connections and automatic default model injection.
- [Audit Log Middleware](https://kipchak.dev/docs/mw-audit): Signed, structured records of who did what, when and from where in your Kipchak API, with personal data redacted, written to Kafka, OpenSearch, NATS JetStream or the log.
- [Circuit Breaker Middleware](https://kipchak.dev/docs/mw-circuit-breaker): Fleet-wide circuit breakers for your Kipchak API's downstream calls, with state shared in Valkey, so every worker on every host fails fast together and recovers together.
- [ClickHouse Driver](https://kipchak.dev/docs/driver-clickhouse): Run analytics queries, stream large results and insert events in batches from your Kipchak API with ClickHouse.
- [ClouDNS Driver](https://kipchak.dev/docs/driver-cloudns): Manage ClouDNS DNS zones and records from Kipchak using the ClouDNS API.
- [Cloudflare DNS Driver](https://kipchak.dev/docs/driver-cloudflare-dns): Manage Cloudflare DNS zones and records from Kipchak using the Cloudflare API v4.
- [Configuration](https://kipchak.dev/docs/configuration): Understanding how to configure your Kipchak application.
- [Consumer Identity](https://kipchak.dev/docs/identity): Tell Kipchak who each request is from, once, for usage metering and quotas, whether clients use API keys, tokens from an identity provider, or signed requests.
- [Controllers](https://kipchak.dev/docs/controllers): Understanding and writing controllers in Kipchak
- [Data Transfer Objects](https://kipchak.dev/docs/dtos): Using DTOs to write great objects in your Kipchak API
- [Deployment](https://kipchak.dev/docs/deployment): Deploying Kipchak with Docker and Kubernetes.
- [Drivers](https://kipchak.dev/docs/drivers): Learn about Kipchak drivers and how they extend your application.
- [Enterprise Licence Terms](https://kipchak.dev/docs/enterprise-terms): The terms on which Mamluk LLC-FZ licenses the Kipchak Enterprise packages, including delivery, support levels, and warranty.
- [Error Handling Middleware](https://kipchak.dev/docs/mw-error): Handle and log errors with virtually zero configuration in Kipchak.
- [Feature Flag Middleware](https://kipchak.dev/docs/mw-feature-flags): Gate Kipchak routes on feature flags from Unleash, Flagsmith or GrowthBook, with rollouts that stay sticky per API key.
- [Feature Flags Driver](https://kipchak.dev/docs/driver-feature-flags): Evaluate feature flags from Unleash, Flagsmith or GrowthBook in your Kipchak API, in process and safe in worker mode, without a flag service outage taking the API down.
- [Getting started](https://kipchak.dev/docs/getting-started)
- [Git Driver](https://kipchak.dev/docs/driver-git): Using the Git driver to interact with Git repositories.
- [Hardened Runtime Image](https://kipchak.dev/docs/runtime-image): The Kipchak Enterprise runtime image runs an API as a single static FrankenPHP binary on an empty filesystem, with no shell, no package manager and no root user.
- [High Performance with Caddy and FrankenPHP](https://kipchak.dev/docs/caddy-and-frankenphp): Learn how Kipchak leverages FrankenPHP for high performance.
- [Idempotency Middleware](https://kipchak.dev/docs/mw-idempotency): Let clients retry POST and PATCH requests safely with the Idempotency-Key header. The first response is stored and replayed, so the operation never runs twice.
- [Kafka Driver](https://kipchak.dev/docs/driver-kafka): An enterprise Kafka driver for Kipchak with support for producing and consuming messages, consumer groups, and SASL/SSL authentication.
- [Kipchak - Credits](https://kipchak.dev/docs/credits): Kipchak Credits
- [Kipchak Enterprise](https://kipchak.dev/docs/enterprise): Enterprise-grade drivers, middleware, support, and managed hosting for teams building production APIs with Kipchak.
- [Kipchak Licence](https://kipchak.dev/docs/license): Kipchak Licence
- [Kipchak Support](https://kipchak.dev/docs/support): Kipchak Support
- [Kipchak Versions](https://kipchak.dev/docs/versioning): Versions and Versioning in Kipchak
- [Kipchak's Core](https://kipchak.dev/docs/core): Understanding the Core Framework
- [LDAP Driver](https://kipchak.dev/docs/driver-ldap): Log users in against LDAP and Active Directory, resolve their groups, and search and change the directory from your Kipchak API.
- [Middleware](https://kipchak.dev/docs/middleware): Using and creating middleware in Kipchak.
- [NATS and JetStream Driver](https://kipchak.dev/docs/driver-nats): Publish and subscribe, request and reply, durable JetStream streams and consumers, and key-value buckets from your Kipchak API with NATS.
- [OAuth2 JWKS Middleware](https://kipchak.dev/docs/mw-auth-jwks): Add OAuth 2 Authentication with JWKS validation to your Kipchak API.
- [OAuth2 JWT Middleware](https://kipchak.dev/docs/mw-auth-jwt): Add OAuth 2 Authentication with JWT validation to your Kipchak API.
- [OAuth2 Token Driver (Enterprise)](https://kipchak.dev/docs/driver-oauth2-token): Generate and cache OAuth 2.0 client credentials tokens from one or more auth servers.
- [OPA Driver](https://kipchak.dev/docs/driver-opa): Authorisation decisions and policy management with Open Policy Agent in your Kipchak API.
- [OpenSearch Driver](https://kipchak.dev/docs/driver-opensearch): An OpenSearch driver for Kipchak with support for single-node, cluster, managed, and serverless deployments.
- [OpenTelemetry Driver](https://kipchak.dev/docs/driver-opentelemetry): Traces, metrics and logs from your Kipchak API, exported over OTLP, with the HTTP, Doctrine, Valkey and Kafka drivers instrumented automatically and every log line carrying its trace.
- [OpenTelemetry Middleware](https://kipchak.dev/docs/mw-opentelemetry): A server span and request metrics for every request to your Kipchak API, named after its route and continuing the caller's trace, with telemetry exported after each response.
- [PII Redaction Middleware](https://kipchak.dev/docs/mw-redaction): Mask, hash or remove personal data in your Kipchak API's JSON responses and in every log line, without changing your controllers.
- [Quotas Middleware](https://kipchak.dev/docs/mw-quotas): Enforce what each customer's plan allows, on requests and on units such as credits, per consumer, tenant or plan, after authentication.
- [RBAC / ABAC Policy Middleware](https://kipchak.dev/docs/mw-policy): Route-level authorisation for your Kipchak API from roles, permissions and attribute conditions in config, or delegated to Open Policy Agent.
- [Request Signing Middleware](https://kipchak.dev/docs/mw-auth-hmac): Verify HMAC-signed requests and webhooks, with replay protection, in your Kipchak API.
- [Response Cache Middleware](https://kipchak.dev/docs/mw-response-cache): A shared HTTP cache for your Kipchak API following RFC 9111, with ETags, conditional requests, tags and invalidation on writes.
- [Routes](https://kipchak.dev/docs/routes): How to manage routes and HTTP endpoint routing
- [S3 Compatible Object Storage Driver](https://kipchak.dev/docs/driver-object-storage): Using the Object Storage Driver to connect to S3 compatible Storage.
- [SFTP Driver](https://kipchak.dev/docs/driver-sftp): Exchange batch files with partners and other systems over SFTP from your Kipchak API, with host key pinning and no partial files.
- [Starter Project](https://kipchak.dev/docs/starter-project): The smallest complete Kipchak API, with one versioned resource, an OpenAPI document generated from the code, tests and a single container, running in minutes.
- [Subashi Pro WAF Middleware](https://kipchak.dev/docs/mw-subashi-pro): Protect your Kipchak API with configurable WAF rules, rate limiting, and IP intelligence.
- [Subashi WAF Middleware](https://kipchak.dev/docs/mw-subashi): Protecting your API with Subashi, a powerful WAF middleware for Kipchak.
- [The ClamAV Driver](https://kipchak.dev/docs/driver-clamav): Scanning uploads and payloads for malware with ClamAV.
- [The Config Driver](https://kipchak.dev/docs/driver-config): Using the Config driver to access configuration files and manage application settings.
- [The CouchDB Driver](https://kipchak.dev/docs/driver-couchdb): Using the CouchDB Driver to interact with CouchDB
- [The Doctrine Driver](https://kipchak.dev/docs/driver-doctrine): Using the Doctrine driver interacting with MySQL, PostgreSQL, and other databases.
- [The Filecache Driver](https://kipchak.dev/docs/driver-filecache): Using the File driver for caching and data storage on disk.
- [The HTTP Driver](https://kipchak.dev/docs/driver-http): Using the HTTP driver to make HTTP requests and handle responses.
- [The Logger Driver](https://kipchak.dev/docs/driver-logger): Using the Logger driver to log application events and errors.
- [The Memcached Driver](https://kipchak.dev/docs/driver-memcached): Using the Memcached driver for caching and data storage.
- [The OpenAI Driver](https://kipchak.dev/docs/driver-openai): Using the OpenAI driver to access OpenAI APIs from Kipchak.
- [The RabbitMQ Driver](https://kipchak.dev/docs/driver-rabbitmq): Using the Rabbit driver to publish and subscribe to RabbitMQ queues.
- [Upgrading Kipchak](https://kipchak.dev/docs/upgrades): Upgrading Kipchak to the latest version
- [Usage Metering Middleware](https://kipchak.dev/docs/mw-metering): Emit a usage event for every request, per consumer and tenant, to Kafka or your logs, for billing and chargeback.
- [Valkey Cache Driver](https://kipchak.dev/docs/driver-valkey): A Valkey caching driver for Kipchak with support for standalone, sentinel, cluster, and primary-replica topologies.
- [Vault Driver](https://kipchak.dev/docs/driver-vault): Database passwords, API keys and other credentials from HashiCorp Vault or OpenBao in your Kipchak API's config, with KV, Transit and any other secrets engine at runtime.
- [Vector Database Driver](https://kipchak.dev/docs/driver-vector): Semantic search and RAG from your Kipchak API, with one API over Qdrant, PostgreSQL with pgvector and OpenSearch k-NN.