[Qypher]How to implement Qypher

Let’s use Qypher on your own website

Depending on your device, you may need to tap instead of clicking.

Currently, programs written in PHP are published

* php version requires Ver.7.4 or higher, Ver.8.3 or higher is recommended.

Please check if the following are possible before implementing Qypher

Must be able to respond via https access (http:// is not allowed)

The Qypher API encrypts communications internally, but for added security it is only provided in environments that support https communication.

OpenSSL is available

The Qypher API uses the OpenSSL encryption library.

Must be able to freely embed script tags

The Qypher API uses JavaScript for display, QR code analysis, and communication with the Qypher core.

Must be able to communicate with external domains using fetch()

The Qypher API sends the data it analyzes to Qypher on an external domain (https://qypher.be-on.biz) and receives the results after matching with Qypher data.

Must be able to use DOM operations with input type="file" and canvas elements

The Qypher API uses DOM operations for uploading Qypher card, QR code analysis, and button interactions.

Must be able to insert custom elements into HTML

The Qypher API embeds custom elements into HTML before and after sign-in.

Must be able to set up and run server-side code (such as PHP)

The Qypher API requires the installation of a PHP file that includes the secret key. This file is responsible for encrypting and decrypting communications with Qypher, verifying one-time keys, and other critical tasks.

Once the above has been confirmed, let’s proceed to the settings.

First, log in to Qypher.
* The sign-in method is described in “How to use Qypher”.

Click on the Qypher Integration, Integration details of Personal information.

destination website name :

Please enter the official name of the website where Qypher will be implemented.

web address of Home :

Please enter the address of the website’s landing or index page, starting with https.

Sandbox :

While “Sandbox” is selected, the production login screen will display “Under adjustment” and login will not be possible. Once various tests are completed, select “production environment” and click “update”.

number of registrants :

This is the number of users who logged in to your registered website via Qypher. The same user is counted only once even if they log in multiple times.

age requiring parental approval :

Set the age at which parental consent is required. If not needed, please select “no restriction”.

viewable age :

For websites with age restrictions, set the age. If not needed, please select “no restriction”.

language used :

In the future, when a list of websites implementing Qypher is created, sections by available language will be provided. However, if browser auto-translation continues to advance, this section may become unnecessary.

desired data to obtain :

Please select the user data you wish to retrieve from Qypher. The data that can be retrieved depends on your plan. Please check “Plan list”.

web address of Terms of Use :

Please enter the URL of Terms of Use, starting with https.

web address of Privacy policy :

Please enter the URL of Privacy policy, starting with https.

web address of after login :

Please enter the page address to be displayed after login for both Sandbox and production environments, starting with https.

web address of Webhook :

Please enter the URL to receive webhook information for both Sandbox and production environments, starting with https. If you do not use it, you may leave it blank. Webhooks are available with Pro plans or higher.

folder to place API secret key :

When you click “Download API set (ZIP)”, Qypher generates “Secret key file”. Please enter the folder where this “Secret key file” will be placed, starting with https.

Language type of the API secret key :

Currently, only PHP is provided, but support for other languages is planned. At that time, you will be able to select your preferred language here.

Usage plan :

Please select your plan. For details, please read Plan list.

Please place the login page, API secret key, Terms of Use, Privacy policy, Webhook, and the post-login page within the same domain, or within the same subdomain if you are using subdomains.

For users with Pro plans or higher implementing multiple websites, please select the website you wish to edit from the “Download API set (ZIP)” dropdown.

Once the settings are complete, let’s download.

When you click “Download API set (ZIP)”, a compressed file named “QypherAPIset_(WebsiteName).zip” will be downloaded to your download folder. Please double-click it or take similar action to unzip (open) it.

File structure

QypherAPIset_(Website Name)/

├─ apiScript.txt ← Copy and paste this content anywhere in your login page.

├─ A public key consisting of 50 or more random alphanumeric characters(1).php ← PHP file for handling the secret key (Hereafter referred to as the "private key file".)

├─ getData.php ← Please copy and paste this content into the page displayed after login.

├─ README.txt ← User manual

└─ Sandbox/

├─ Sandbox_apiScript.txt ← ( for Sandbox ) Copy and paste this content anywhere in your login page.

├─ Sandbox_A public key consisting of 50 or more random alphanumeric characters(2).php ← ( for Sandbox ) Secret key file

├─ Sandbox_getData.php ← ( for Sandbox ) Please copy and paste this content into the page displayed after login.

├─ nine.jpg ← Sandbox Qypher card test user aged 9 (You can test actions that require guardian approval.)

├─ eleven.jpg ← Sandbox Qypher card test user aged 11 (Can be used to check the age boundary for guardian approval.)

├─ thirty.jpg ← Sandbox Qypher card test user aged 30 (Can log in normally as an adult.)

└─ guardian.jpg ← Sandbox Qypher card test user as parent of 9- and 11-year-olds (Use this to test guardian approval flow.)

Let's try it in Sandbox

In Sandbox, you can carry out various experiments and experiences related to Qypher login.

When logging in from Sandbox, all actions remain within Sandbox and are not reflected in production environment.

Emails within Sandbox are sent only to users using Sandbox.

Copy all contents from Sandbox_apiScript.txt and paste them anywhere on your for Sandbox login page.

By inserting the desired data into the value attribute of <input type="hidden" id="QypherAnyKey" value="">, it can be passed on after login.
( If the entered content includes HTML tags, JavaScript code, file paths, or similar, it will be automatically invalidated. If a harmful value is detected, use of Qypher may be restricted. )

Please place Secret key file for Sandbox in the location specified in folder to place API secret key inside QypherIntegration details.
Please place it in the same location as for production environment.

Do not modify this file under any circumstances. If modified, it may be invalidated by Qypher core verification, and the login request may be rejected.
Do not rename the file. Qypher will not be able to identify it.

After uploading, make sure the file permissions are set correctly.

Recommended 604 or 644
*If you are using a Windows server, the above “604 / 644” permission settings are not required, but please ensure that the file is accessible by the web server (e.g., IIS) with appropriate permissions.

Copy all contents from Sandbox_getData.txt and use them as the main structure of your for Sandbox post-login page.

Enter the post-login content in if($Qypher["success"]){} , and the failure content in else{} if login fails.
The default value upon a successful login contains “Reloading this page will require you to log in again.”.

The PHP program placed on the post-login page calls Secret key file and decrypts that data.

At that time, the encrypted login timestamp is verified as a one-time password. If this timestamp differs by more than 5 seconds, the login is rejected.

This is an important measure to prevent someone else from returning to the login page and reloading it after a user has logged out and thereby gaining access.

Making any changes inside Secret key file could create a security vulnerability, so do NOT modify it under any circumstances.

Let's retrieve user data from Qypher

It can be retrieved in the $Qypher array.

$Qypher["success"] ← true = Login successful, false = Login failed
$Qypher["uuid"] ← Qypher identifier for login record ( Use this when contacting Qypher )
$Qypher["Qypher_ID"] ← User’s unique ID ( Use this to identify which user logged in )
$Qypher["login_time(UTC)"] ← YYYY-MM-DDThh:ii:ssZ ( The login time is available in UTC )
$Qypher["meetsAgeReq"] ← Whether the user meets the site's age requirement (1 = yes, 0 = no). Usually 1 on a successful login. The exact age and date of birth are never sent.
$Qypher["ageReq"] ← The age threshold set by the site (0 = none set)
$Qypher["guardianApproved"] ← Whether the user's age is below the guardian threshold — the needGuardian value (13 if unset; under-13 always applies regardless of the setting) (1/0). Qypher never completes a login without guardian consent, so 1 means a young user who logged in with that consent
$Qypher["under10"] ← A coarse "under 10" flag (1/0), for switching to child-friendly wording or layout. The exact age and date of birth are not sent; it flips only once at the age-10 boundary, so repeated logins cannot reveal the birthday.
$Qypher["under13"] ← A coarse "under 13" flag (1/0). Like under10, it lets you switch wording by age band without receiving the exact age; it flips only once at the age-13 boundary.
$Qypher["QypherAnyKey"] ← Data to carry over from the login page ( This is the data written in the value attribute of id="QypherAnyKey" in apiScript.txt. )
$Qypher["json"] ← JSON format of all data ( Use this for JavaScript processing and more )

By default, the data provided by Qypher includes the above items.If you check each item in desired data to obtain inside QypherIntegration details, more data will be provided. However, data that the user has not permitted to send or has not registered will be empty.

$Qypher["surname"] ← Last name
$Qypher["givenName"] ← First name
$Qypher["nickname"] ← Nickname
$Qypher["email"] ← Email address
$Qypher["birthday"] ← Date of birth
$Qypher["postalCode"] ← Postal code
$Qypher["country"] ← Country / Region
$Qypher["area1"] ← State / Province
$Qypher["area2"] ← City / Town / Village
$Qypher["address"] ← Street address
$Qypher["building"] ← Building name
$Qypher["room"] ← Room name

e.g. echo `Dear {$Qypher["givenName"]} {$Qypher["surname"]}, Welcome to Qypher.`;

Please handle personal information with great care.

Let's prepare production environment

In production environment, the public and private keys differ from those used in Sandbox. Simply copying the contents of Sandbox will not make production environment work.

Set up production environment following the same steps as in Sandbox.

Copy all contents from apiScript.txt and paste them anywhere on your for production environment login page.

Please place Secret key file for production environment in the location specified in folder to place API secret key inside QypherIntegration details.
Please place it in the same location as for Sandbox.

After uploading, make sure the file permissions are set correctly.

Copy all contents from getData.txt and use them as the main structure of your for production environment post-login page.

If the login page shows “Checking the installation location”, please check whether you are not using the Sandbox version, or if you are using Qypher on multiple pages, ensure you are using the correct one for that site.

Use Webhook to ensure the reliability of your information.

Webhook is available with the Pro plan and above. After a user logs in, if the information could not be processed properly, please use Webhook.

For Pro plan users and above, when you download the API, the folder includes two files: webhook.php and Sandbox_webhook.php. Please use them by adding to these as they are.

Data retrieval is the same as the method used on the post-login page.

Enter the location where you placed the file into Qypher Integration details under Webhook, starting with https, and click update.

If you are not using Webhook, leave Qypher Integration details under Webhook blank and click update.

Login Revolution. Smart authentication with Qypher, using only QR.

Login Revolution.
Smart authentication with Qypher, using only QR.