PHPAML

Documentation · Chapter 06

Read the manifest
without fearing it.

phpaml.json is the project's technical identity card. JSON has strict syntax, but its structure stays readable.

No real secret is required: we configure reading-list with safe values.

A realistic excerpt

phpaml — zsh
{
  "name": "reading-list",
  "application": {
    "type": "classic",
    "views": "src/views",
    "debug": false,
    "error_views": "src/views/errors",
    "session": { "lifetime": 7200, "same_site": "Lax" },
    "rate_limit": { "enabled": true, "limit": 60, "window": 60 }
  },
  "database": {
    "dsn": "sqlite:runtime/storage/database.sqlite"
  },
  "requirements": { "php": "^8.2" }
}

Braces contain objects, brackets contain lists, and colons separate keys from values. JSON accepts neither comments nor a comma after the last property.

What the sections describe

applicationtype, views, sessions, errors, rate limiting
databasenon-secret default connection
seopublic identity and indexing
runtimedirectory and Framework version
scriptsconvenient commands
requirementsexpected PHP version
modulesinstalled modules

A simple decision rule

Ask: ‘Can this value be identical for everyone and public on GitHub?’ If yes, it can usually live in phpaml.json. If it contains a secret or depends on the server, put it in .env.

Check your understanding: Where should the default session lifetime go?

In phpaml.json: it is a shareable project choice.