Pro

Sure, AI can write it.
But who's going to maintain it?

Services you'd normally write yourself come fully tested and documented, with a common-sense API.

Here's a login form.

Sessions, password hashing and remember-me are fully handled, right out of the box.

$form->create('Email, Password|password, Remember Me|checkbox');

if ($form->submitted()) {
    $request = $form->request('Email[required, email], Password[required], remember_me');

    if ($form->ok()) {
        $user = $form->sql->find('users', ['email' => $request['email']]);

        if ($user && $form->auth->verify($request['password'], $user['password'])) {
            $form->auth->login($user['id'], !empty($request['remember_me']));
            $form->redirect('/dashboard');
        }

        $form->addError('email', 'Invalid credentials.');
    }
}

WHAT YOU'D WRITE YOURSELF

Session handling, with the session id regenerated on login
Bcrypt hashing with PASSWORD_DEFAULT, and rehashing when the cost changes
Remember-me cookies signed with HMAC-SHA256
Tokens stored hashed, rotated on every restore, dead on logout
Timing-safe comparison, so a token can't be guessed a byte at a time

And then keep all of it current every time PHP changes.

Identity & Access

OTP

One-time codes for passwordless login, email verification, and two-factor.

Throttle

Per-client rate limiting for logins, OTP sends, and form submissions.

Data & Input

SQL

MySQL, Postgres, SQLite, and SQL Server behind one set of methods.

Upload

Resizes and stores files and images, including to S3 and Spaces.

Validation

The same 40+ rules you use on the server, running in the browser.

Payments & Messaging

Checkout

Polar and Stripe hosted checkout. Redirect, then confirm with a webhook.

Mail

SMTP, SES, SendGrid, Mailgun, and Postmark. Changing providers is a config change.

Bot Protection

reCAPTCHA

Google's invisible bot check. Your users never see a CAPTCHA.

Turnstile

Cloudflare's bot protection. No puzzles for your users to solve.

What's next? Support us and find out.

Your tenth project should work like your first.

Every time you add uploads, email, or a login to a project, you make slightly different choices about where the files land, what happens when a send fails, and how long a session lives. Multiply that across every project you'll ever build and... well, you get the picture. Flick Pro is one codebase with one set of conventions, and you install it the same way every time.

Flick Pro

Every project you build, including client work.

$99 per year

Get Flick Pro

30 days, no questions asked.
Subscription renews yearly until canceled.

Keep every version you paid for

All ten Pro services

Use it on every project

Client work included

Security updates included

Updated for new PHP releases

New services while you subscribe

Sure, AI can write it.But who's going to maintain it?