diff --git a/composer.json b/composer.json
index 90d6fcf..bdb5bca 100644
--- a/composer.json
+++ b/composer.json
@@ -10,7 +10,10 @@
     ],
     "type": "library",
     "require": {
-        "php": ">=7.4 <=8.4.1"
+        "php": ">=7.4 <=8.4.1",
+        "ext-json": "*",
+        "ext-openssl": "*",
+        "ext-curl": "*"
     },
     "license": "MIT",
     "autoload": {
@@ -39,7 +42,8 @@
         "phpunit/phpunit": "^9.6",
         "slevomat/coding-standard": "^8.4",
         "squizlabs/php_codesniffer": "^3.11",
-        "vimeo/psalm": "^4.9"
+        "vimeo/psalm": "^4.9",
+        "friendsofphp/php-cs-fixer": "^3.65"
     },
     "scripts": {
         "analyze": [
diff --git a/src/Config/ConfigInterface.php b/src/Config/ConfigInterface.php
index d392284..921d25b 100644
--- a/src/Config/ConfigInterface.php
+++ b/src/Config/ConfigInterface.php
@@ -6,10 +6,15 @@ interface ConfigInterface
 {
     public function getProduction(): bool;
     public function getSameSiteStrict(): ?bool;
+    /**  @return array<string, int|string>|null */
     public function getError(): ?array;
+    /**  @return array<string, string>|null */
     public function getScope(): ?array;
+    /**  @return array<string>|null */
     public function getProviderHint(): ?array;
+    /**  @return array<string, string> */
     public function getRoutes(): array;
+    /**  @return array<string, string> */
     public function getCookies(): array;
     public function getLoginSync(): ?callable;
     public function getLogoutSync(): ?callable;
diff --git a/src/Config/Constants.php b/src/Config/Constants.php
index 0aa3c28..23a7432 100644
--- a/src/Config/Constants.php
+++ b/src/Config/Constants.php
@@ -7,22 +7,30 @@ class Constants
     public static string $PRODUCTION_WALLET = 'https://wallet.hello.coop';
     public static string $DEFAULT_PATH = '/authorize';
     public static string $HELLO_API_ROUTE =  '/api/hellocoop';
+    /** @var array<string> */
     public static array $DEFAULT_SCOPE = ['openid', 'name', 'email', 'picture'];
     public static string $DEFAULT_RESPONSE_TYPE = 'code';
     public static string $DEFAULT_RESPONSE_MODE = 'query';
 
+    /** @var array<string> */
     public static array $VALID_IDENTITY_STRING_CLAIMS = [
         'name', 'nickname', 'preferred_username', 'given_name', 'family_name',
         'email', 'phone', 'picture', 'ethereum',
     ];
 
+    /**
+     * @var array<string>
+     */
     public static array $VALID_IDENTITY_ACCOUNT_CLAIMS = [
         'discord', 'twitter', 'github', 'gitlab'
     ];
 
     public static string $ORG_CLAIM = 'org';
 
-    public static function getValidIdentityClaims()
+    /**
+     * @return array<string>
+     */
+    public static function getValidIdentityClaims(): array
     {
         return array_merge(
             self::$VALID_IDENTITY_STRING_CLAIMS,
@@ -31,7 +39,10 @@ public static function getValidIdentityClaims()
         );
     }
 
-    public static function getValidScopes()
+    /**
+     * @return array<string>
+     */
+    public static function getValidScopes(): array
     {
         return array_merge(
             self::$VALID_IDENTITY_STRING_CLAIMS,
@@ -40,9 +51,11 @@ public static function getValidScopes()
         );
     }
 
+    /** @var array<string> */
     public static array $VALID_RESPONSE_TYPE = ['id_token', 'code'];
+    /** @var array<string> */
     public static array $VALID_RESPONSE_MODE = ['fragment', 'query', 'form_post'];
-
+    /** @var array<string> */
     public static array $VALID_PROVIDER_HINT = [
         'apple', 'discord', 'facebook', 'github', 'gitlab', 'google',
         'twitch', 'twitter', 'tumblr', 'mastodon', 'microsoft', 'line',
diff --git a/src/Config/HelloConfig.php b/src/Config/HelloConfig.php
index 4710484..fd04895 100644
--- a/src/Config/HelloConfig.php
+++ b/src/Config/HelloConfig.php
@@ -17,15 +17,45 @@ class HelloConfig implements ConfigInterface
     private string $host;
     private ?string $secret = null;
     private ?bool $logDebug = null;
+    /** @var array<string, int|string>|null */
     private ?array $error = null;
+    /** @var array<string> */
     private array $scope;
+    /** @var array<string> */
     private array $providerHint;
+    /** @var array<string, string> */
     private array $routes;
+    /** @var array<string, string> */
     private array $cookies;
+    /** @var callable|null */
     private $loginSync;
+    /** @var callable|null */
     private $logoutSync;
     private bool $production;
 
+    /**
+     * @param string $apiRoute
+     * @param string $authApiRoute
+     * @param string $loginApiRoute
+     * @param string $logoutApiRoute
+     * @param bool $sameSiteStrict
+     * @param string|null $clientId
+     * @param string|null $redirectURI
+     * @param string $host
+     * @param string|null $secret
+     * @param callable|null $loginSync
+     * @param callable|null $logoutSync
+     * @param array<string, string> $cookies
+     * @param bool $production
+     * @param string $helloDomain
+     * @param string|null $helloWallet
+     * @param array<string> $scope
+     * @param array<string> $providerHint
+     * @param array<string, string> $routes
+     * @param bool|null $cookieToken
+     * @param bool|null $logDebug
+     * @param array<string, int|string>|null $error
+     */
     public function __construct(
         string $apiRoute,
         string $authApiRoute,
@@ -89,26 +119,41 @@ public function getSameSiteStrict(): ?bool
         return $this->sameSiteStrict;
     }
 
+    /**
+     * @return array<string, int|string>|null
+     */
     public function getError(): ?array
     {
         return $this->error;
     }
 
+    /**
+     * @return array<string>|null
+     */
     public function getScope(): ?array
     {
         return $this->scope;
     }
 
+    /**
+     * @return array<string>|null
+     */
     public function getProviderHint(): ?array
     {
         return $this->providerHint;
     }
 
+    /**
+     * @return array<string, string>
+     */
     public function getRoutes(): array
     {
         return $this->routes;
     }
 
+    /**
+     * @return array<string, string>
+     */
     public function getCookies(): array
     {
         return $this->cookies;
diff --git a/src/Config/HelloConfigBuilder.php b/src/Config/HelloConfigBuilder.php
index 010270c..1266a4d 100644
--- a/src/Config/HelloConfigBuilder.php
+++ b/src/Config/HelloConfigBuilder.php
@@ -13,6 +13,7 @@ class HelloConfigBuilder
     private ?string $redirectURI = null;
     private string $host = '';
     private ?string $secret = null;
+    /**  @var array<string, string> */
     private array $cookies = [
         'authName' => 'hellocoop_auth',
         'oidcName' => 'hellocoop_oidc',
@@ -20,17 +21,23 @@ class HelloConfigBuilder
     private bool $production = true;
     private string $helloDomain = 'hello.coop';
     private ?string $helloWallet = null;
+    /**  @var array<string> */
     private array $scope = ['openid', 'name', 'email', 'picture'];
+    /**  @var array<string> */
     private array $providerHint = ['github'];
+    /**  @var array<string, string> */
     private array $routes = [
         'loggedIn' => '/',
         'loggedOut' => '/',
         'error' => '/error',
     ];
+    /**  @var callable|null */
     private $loginSync = null;
+    /**  @var callable|null */
     private $logoutSync = null;
     private ?bool $cookieToken = null;
     private ?bool $logDebug = null;
+    /**  @var array<string, int|string>|null */
     private ?array $error = null;
 
     public function setApiRoute(string $apiRoute): self
@@ -87,6 +94,9 @@ public function setSecret(?string $secret): self
         return $this;
     }
 
+    /**
+     * @param array<string, string> $cookies
+     */
     public function setCookies(array $cookies): self
     {
         $this->cookies = $cookies;
@@ -111,30 +121,47 @@ public function setHelloWallet(?string $helloWallet): self
         return $this;
     }
 
+    /**
+     * @param array<string> $scope
+     */
     public function setScope(array $scope): self
     {
         $this->scope = $scope;
         return $this;
     }
 
+    /**
+     * @param array<string> $providerHint
+     */
     public function setProviderHint(array $providerHint): self
     {
         $this->providerHint = $providerHint;
         return $this;
     }
 
+    /**
+     * @param array<string, string> $routes
+     */
     public function setRoutes(array $routes): self
     {
         $this->routes = $routes;
         return $this;
     }
 
+    /**
+     * @param callable|null $loginSync
+     * @return HelloConfigBuilder
+     */
     public function setLoginSync(?callable $loginSync): self
     {
         $this->loginSync = $loginSync;
         return $this;
     }
 
+    /**
+     * @param callable|null $logoutSync
+     * @return HelloConfigBuilder
+     */
     public function setLogoutSync(?callable $logoutSync): self
     {
         $this->logoutSync = $logoutSync;
@@ -153,6 +180,9 @@ public function setLogDebug(?bool $logDebug): self
         return $this;
     }
 
+    /**
+     * @param array<string, int|string>|null $error
+     */
     public function setError(?array $error): self
     {
         $this->error = $error;
diff --git a/src/Exception/CallbackException.php b/src/Exception/CallbackException.php
index b5c3d65..840e6a7 100644
--- a/src/Exception/CallbackException.php
+++ b/src/Exception/CallbackException.php
@@ -7,8 +7,15 @@
 
 class CallbackException extends Exception
 {
+    /** @var array<string, int|string> */
     private array $errorDetails;
 
+    /**
+     * @param array<string, int|string> $errorDetails
+     * @param string $message
+     * @param int $code
+     * @param Throwable|null $previous
+     */
     public function __construct(
         array $errorDetails,
         $message = "Callback Exception",
@@ -19,6 +26,9 @@ public function __construct(
         parent::__construct($message, $code, $previous);
     }
 
+    /**
+     * @return array<string, int|string>
+     */
     public function getErrorDetails(): array
     {
         return $this->errorDetails;
diff --git a/src/Exception/CryptoFailedException.php b/src/Exception/CryptoFailedException.php
index 63e8f16..b70c991 100644
--- a/src/Exception/CryptoFailedException.php
+++ b/src/Exception/CryptoFailedException.php
@@ -6,5 +6,6 @@
 
 class CryptoFailedException extends Exception
 {
+    /** @var string  */
     protected $message = 'Crypto failed. There was an error encrypting the data.';
 }
diff --git a/src/Exception/DecryptionFailedException.php b/src/Exception/DecryptionFailedException.php
index c9a7641..4dbaa51 100644
--- a/src/Exception/DecryptionFailedException.php
+++ b/src/Exception/DecryptionFailedException.php
@@ -6,5 +6,6 @@
 
 class DecryptionFailedException extends Exception
 {
+    /** @var string  */
     protected $message = 'Decryption failed. The data may be corrupted or the wrong key was used.';
 }
diff --git a/src/Exception/InvalidSecretException.php b/src/Exception/InvalidSecretException.php
index 015018b..57bac4b 100644
--- a/src/Exception/InvalidSecretException.php
+++ b/src/Exception/InvalidSecretException.php
@@ -6,5 +6,6 @@
 
 class InvalidSecretException extends Exception
 {
+    /** @var string  */
     protected $message = 'Invalid secret key. Must be a 64-character hexadecimal string.';
 }
diff --git a/src/Exception/NotImplementedException.php b/src/Exception/NotImplementedException.php
index ff5866d..d5a7679 100644
--- a/src/Exception/NotImplementedException.php
+++ b/src/Exception/NotImplementedException.php
@@ -6,4 +6,6 @@
 
 class NotImplementedException extends BadMethodCallException
 {
+    /** @var string  */
+    protected $message = 'Not Implemented.';
 }
diff --git a/src/Exception/SameSiteCallbackException.php b/src/Exception/SameSiteCallbackException.php
index 2930bf6..d72cba5 100644
--- a/src/Exception/SameSiteCallbackException.php
+++ b/src/Exception/SameSiteCallbackException.php
@@ -7,8 +7,11 @@
 
 class SameSiteCallbackException extends Exception
 {
-    private array $errorDetails;
-
+    /**
+     * @param string $message
+     * @param int $code
+     * @param Throwable|null $previous
+     */
     public function __construct(
         $message = "Same Site Callback Exception",
         $code = 0,
diff --git a/src/Handler/Auth.php b/src/Handler/Auth.php
index 497ee70..8a28473 100644
--- a/src/Handler/Auth.php
+++ b/src/Handler/Auth.php
@@ -15,6 +15,7 @@ class Auth
     private HelloRequestInterface $helloRequest;
     private ConfigInterface $config;
     private ?AuthLib $authLib = null;
+
     public function __construct(
         HelloRequestInterface $helloRequest,
         HelloResponseInterface $helloResponse,
@@ -38,6 +39,7 @@ public function handleAuth(): ?AuthType
     {
         return $this->getAuthLib()->getAuthfromCookies();
     }
+
     public function updateAuth(AuthUpdates $authUpdates): ?AuthType
     {
         $auth = $this->getAuthLib()->getAuthfromCookies();
@@ -48,6 +50,7 @@ public function updateAuth(AuthUpdates $authUpdates): ?AuthType
         $updatedAuth = array_merge($auth->toArray(), $authUpdates->toArray());
         return AuthType::fromArray($updatedAuth);
     }
+
     public function clearAuth(): void
     {
         $this->getAuthLib()->clearAuthCookie();
diff --git a/src/Handler/Callback.php b/src/Handler/Callback.php
index da2b85a..b7b7f1f 100644
--- a/src/Handler/Callback.php
+++ b/src/Handler/Callback.php
@@ -2,6 +2,7 @@
 
 namespace HelloCoop\Handler;
 
+use HelloCoop\Exception\InvalidSecretException;
 use HelloCoop\HelloResponse\HelloResponseInterface;
 use HelloCoop\HelloRequest\HelloRequestInterface;
 use HelloCoop\Config\ConfigInterface;
@@ -38,6 +39,9 @@ public function __construct(
         $this->config = $config;
     }
 
+    /**
+     * @throws InvalidSecretException
+     */
     private function getOIDCManager(): OIDCManager
     {
         return $this->oidcManager ??= new OIDCManager(
@@ -61,6 +65,7 @@ private function getTokenFetcher(): TokenFetcher
     {
         return $this->tokenFetcher ??= new TokenFetcher(new CurlWrapper());
     }
+
     private function getTokenParser(): TokenParser
     {
         return $this->tokenParser ??= new TokenParser();
@@ -87,7 +92,8 @@ public function handleCallback(): ?string
                 throw new SameSiteCallbackException();
             }
 
-            $oidcState = $this->getOIDCManager()->getOidc()->toArray();
+            $oidc = $this->getOIDCManager()->getOidc();
+            $oidcState = ($oidc) ? $oidc->toArray() : [];
             if (!$oidcState) {
                 return $this->sendErrorPage([
                     'error' => 'invalid_request',
@@ -132,7 +138,7 @@ public function handleCallback(): ?string
             $this->getOIDCManager()->clearOidcCookie();
 
             $token = $this->getTokenFetcher()->fetchToken([
-                'code' => (string) $code,
+                'code' => $code,
                 'wallet' => $this->config->getHelloWallet(),
                 'code_verifier' => $codeVerifier,
                 'redirect_uri' => $redirectUri,
@@ -189,7 +195,7 @@ public function handleCallback(): ?string
                 }
             }
 
-            if ($auth['isLoggedIn'] && isset($payload['org'])) {
+            if (isset($payload['org'])) {
                 $auth['authCookie']['org'] = $payload['org'];
             }
 
@@ -259,7 +265,7 @@ public function handleCallback(): ?string
      * Uses the target URI from error details or a fallback error route. Updates the query
      * string with error information. Throws an exception if no error URI is available.
      *
-     * @param array $error Error details including 'target_uri', 'error', and 'error_description'.
+     * @param array<string, int|string|null> $error Error details including 'target_uri', 'error', and 'error_description'.
      * @param string $errorMessage A message describing the error.
      * @param Throwable|null $previous Previous exception for chaining (optional).
      *
@@ -271,7 +277,7 @@ private function sendErrorPage(array $error, string $errorMessage, ?Throwable $p
     {
         $error_uri = $error['target_uri'] ?? $this->config->getRoutes()['error'] ?? null;
         if ($error_uri) {
-            list($pathString, $queryString) = array_pad(explode('?', $error_uri, 2), 2, '');
+            list($pathString, $queryString) = array_pad(explode('?', (string) $error_uri, 2), 2, '');
             // Parse the query string into an array
             parse_str($queryString, $queryArray);
             foreach ($error as $key => $value) {
diff --git a/src/Handler/Invite.php b/src/Handler/Invite.php
index 182695a..7a697ca 100644
--- a/src/Handler/Invite.php
+++ b/src/Handler/Invite.php
@@ -2,6 +2,7 @@
 
 namespace HelloCoop\Handler;
 
+use Exception;
 use HelloCoop\HelloResponse\HelloResponseInterface;
 use HelloCoop\HelloRequest\HelloRequestInterface;
 use HelloCoop\Config\ConfigInterface;
@@ -13,6 +14,7 @@ class Invite
     private HelloRequestInterface $helloRequest;
     private ConfigInterface $config;
     private ?AuthLib $authLib = null;
+
     public function __construct(
         HelloRequestInterface $helloRequest,
         HelloResponseInterface $helloResponse,
@@ -32,6 +34,9 @@ private function getAuthLib(): AuthLib
         );
     }
 
+    /**
+     * @throws Exception
+     */
     public function generateInviteUrl(): string
     {
         $params = $this->helloRequest->fetchMultiple([
@@ -46,7 +51,11 @@ public function generateInviteUrl(): string
 
         $auth = $this->getAuthLib()->getAuthfromCookies();
         if (empty($auth->toArray()['authCookie'])) {
-            throw new \Exception("User not logged in");
+            throw new Exception("User not logged in");
+        }
+
+        if (empty($auth->toArray()['authCookie']['sub'])) {
+            throw new Exception("User coookie missing");
         }
 
         $request = [
@@ -62,7 +71,6 @@ public function generateInviteUrl(): string
         ];
 
         $queryString = http_build_query($request);
-        $url = "https://wallet.{$this->config->getHelloDomain()}/invite?" . $queryString;
-        return $url;
+        return "https://wallet.{$this->config->getHelloDomain()}/invite?" . $queryString;
     }
 }
diff --git a/src/Handler/Login.php b/src/Handler/Login.php
index 7834ee3..753da61 100644
--- a/src/Handler/Login.php
+++ b/src/Handler/Login.php
@@ -2,6 +2,8 @@
 
 namespace HelloCoop\Handler;
 
+use HelloCoop\Exception\CryptoFailedException;
+use HelloCoop\Exception\InvalidSecretException;
 use HelloCoop\HelloResponse\HelloResponseInterface;
 use HelloCoop\HelloRequest\HelloRequestInterface;
 use HelloCoop\Config\ConfigInterface;
@@ -20,8 +22,15 @@ class Login
     private OIDCManager $oidcManager;
     private AuthHelper $authHelper;
 
+    /** @var array<string>  */
     private array $redirectURIs;
 
+    /**
+     * @param HelloRequestInterface $helloRequest
+     * @param HelloResponseInterface $helloResponse
+     * @param ConfigInterface $config
+     * @param array<string> $redirectURIs
+     */
     public function __construct(
         HelloRequestInterface $helloRequest,
         HelloResponseInterface $helloResponse,
@@ -34,6 +43,9 @@ public function __construct(
         $this->redirectURIs = $redirectURIs;
     }
 
+    /**
+     * @throws InvalidSecretException
+     */
     private function getOIDCManager(): OIDCManager
     {
         return $this->oidcManager ??= new OIDCManager(
@@ -49,6 +61,9 @@ private function getAuthHelper(): AuthHelper
         return $this->authHelper ??= new AuthHelper(new PKCE());
     }
 
+    /**
+     * @throws CryptoFailedException|InvalidSecretException
+     */
     public function generateLoginUrl(): ?string
     {
         $params = $this->helloRequest->fetchMultiple([
@@ -112,6 +127,6 @@ public function generateLoginUrl(): ?string
             'target_uri' => $params['target_uri'],
         ]));
 
-        return $authResponse['url'];
+        return is_string($authResponse['url']) ? $authResponse['url'] : null;
     }
 }
diff --git a/src/HelloClient.php b/src/HelloClient.php
index 554d562..2465754 100644
--- a/src/HelloClient.php
+++ b/src/HelloClient.php
@@ -2,6 +2,9 @@
 
 namespace HelloCoop;
 
+use Exception;
+use HelloCoop\Exception\CryptoFailedException;
+use HelloCoop\Exception\InvalidSecretException;
 use HelloCoop\HelloRequest\HelloRequestInterface;
 use HelloCoop\HelloRequest\HelloRequest;
 use HelloCoop\HelloResponse\HelloResponseInterface;
@@ -20,9 +23,9 @@
 class HelloClient
 {
     private ConfigInterface $config;
-    private ?HelloResponseInterface $helloResponse;
-    private ?HelloRequestInterface $helloRequest;
-    private ?PageRendererInterface $pageRenderer;
+    private HelloResponseInterface $helloResponse;
+    private HelloRequestInterface $helloRequest;
+    private PageRendererInterface $pageRenderer;
     private ?Callback $callbackHandler = null;
     private ?Auth $authHandler = null;
     private ?Invite $invite = null;
@@ -87,11 +90,18 @@ private function getLoginHandler(): Login
         );
     }
 
+    /**
+     * @return array<string, bool|string|array<string, mixed>|null>
+     */
     public function getAuth(): array
     {
-        return $this->getAuthHandler()->handleAuth()->toArray();
+        return $this->getAuthHandler()->handleAuth() ? $this->getAuthHandler()->handleAuth()->toArray() : [];
     }
 
+    /**
+     * @throws InvalidSecretException
+     * @throws CryptoFailedException
+     */
     private function handleLogin()
     {
         return $this->helloResponse->redirect($this->getLoginHandler()->generateLoginUrl());
@@ -102,6 +112,9 @@ private function handleLogout()
         return $this->helloResponse->redirect($this->getLogoutHandler()->generateLogoutUrl());
     }
 
+    /**
+     * @throws Exception
+     */
     private function handleInvite()
     {
         return $this->helloResponse->redirect($this->getInviteHandler()->generateInviteUrl());
@@ -150,7 +163,7 @@ public function route()
                 case 'invite':
                     return $this->handleInvite();
                 default:
-                    throw new \Exception('unknown query: ' . $op);
+                    throw new Exception('unknown query: ' . $op);
                     //TODO: add 500 error here;
             }
         }
diff --git a/src/HelloRequest/HelloRequest.php b/src/HelloRequest/HelloRequest.php
index 9f9fe37..3630083 100644
--- a/src/HelloRequest/HelloRequest.php
+++ b/src/HelloRequest/HelloRequest.php
@@ -10,10 +10,10 @@ class HelloRequest implements HelloRequestInterface
      * Fetch a parameter by key from either GET or POST data.
      *
      * @param string $key The key of the parameter to fetch.
-     * @param mixed $default Default value if the key is not found.
-     * @return mixed The value of the parameter or default.
+     * @param string|null $default Default value if the key is not found.
+     * @return string|null The value of the parameter or default.
      */
-    public function fetch(string $key, $default = null): ?string
+    public function fetch(string $key, string $default = null): ?string
     {
         // First check GET, then POST if not found.
         return $_GET[$key] ?? $_POST[$key] ?? $default;
@@ -22,8 +22,8 @@ public function fetch(string $key, $default = null): ?string
     /**
      * Fetch multiple parameters by keys from either GET or POST data.
      *
-     * @param array $keys The keys of the parameters to fetch.
-     * @return array An associative array of parameters.
+     * @param array<string> $keys The keys of the parameters to fetch.
+     * @return array<string, string|null> An associative array of parameters.
      */
     public function fetchMultiple(array $keys): array
     {
@@ -38,16 +38,16 @@ public function fetchMultiple(array $keys): array
      * Fetch a header by key from the request headers.
      *
      * @param string $key The key of the header to fetch.
-     * @param mixed $default Default value if the key is not found.
-     * @return mixed The value of the header or default.
+     * @param string|null $default Default value if the key is not found.
+     * @return string|null The value of the header or default.
      */
-    public function fetchHeader(string $key, $default = null): ?string
+    public function fetchHeader(string $key, string $default = null): ?string
     {
         $headers = $this->getAllHeaders();
         $normalizedKey = strtolower($key);
-        foreach ($headers as $headerKey => $value) {
+        foreach ($headers as $headerKey => $headerValue) {
             if (strtolower($headerKey) === $normalizedKey) {
-                return $value;
+                return $headerValue;
             }
         }
         return $default;
@@ -56,7 +56,7 @@ public function fetchHeader(string $key, $default = null): ?string
     /**
      * Retrieve all request headers.
      *
-     * @return array An associative array of all request headers.
+     * @return array<string, string> An associative array of all request headers.
      */
     private function getAllHeaders(): array
     {
diff --git a/src/HelloRequest/HelloRequestInterface.php b/src/HelloRequest/HelloRequestInterface.php
index b0a5493..f073b83 100644
--- a/src/HelloRequest/HelloRequestInterface.php
+++ b/src/HelloRequest/HelloRequestInterface.php
@@ -8,16 +8,16 @@ interface HelloRequestInterface
      * Fetch a parameter by key from either GET or POST data.
      *
      * @param string $key The key of the parameter to fetch.
-     * @param mixed $default Default value if the key is not found.
-     * @return mixed The value of the parameter or default.
+     * @param string|null $default Default value if the key is not found.
+     * @return string|null The value of the parameter or default.
      */
-    public function fetch(string $key, $default = null): ?string;
+    public function fetch(string $key, string $default = null): ?string;
 
     /**
      * Fetch multiple parameters by keys from either GET or POST data.
      *
-     * @param array $keys The keys of the parameters to fetch.
-     * @return array An associative array of parameters.
+     * @param array<string> $keys The keys of the parameters to fetch.
+     * @return array<string, string> An associative array of parameters.
      */
     public function fetchMultiple(array $keys): array;
 
@@ -25,10 +25,10 @@ public function fetchMultiple(array $keys): array;
      * Fetch a header by key from the request headers.
      *
      * @param string $key The key of the header to fetch.
-     * @param mixed $default Default value if the key is not found.
-     * @return mixed The value of the header or default.
+     * @param string|null $default Default value if the key is not found.
+     * @return string|null The value of the header or default.
      */
-    public function fetchHeader(string $key, $default = null): ?string;
+    public function fetchHeader(string $key, string $default = null): ?string;
 
     /**
      * Fetch a cookie value by name.
diff --git a/src/HelloResponse/HelloResponse.php b/src/HelloResponse/HelloResponse.php
index 8f3360f..ee15b36 100644
--- a/src/HelloResponse/HelloResponse.php
+++ b/src/HelloResponse/HelloResponse.php
@@ -27,7 +27,8 @@ public function setHeader(string $name, $value): void
     /**
      * Deletes a cookie by setting its expiration time to the past.
      *
-     * This method sets the cookie's value to an empty string and its expiration time to one hour before the current time, which effectively deletes it.
+     * This method sets the cookie's value to an empty string and its expiration time to one hour before the current
+     * time, which effectively deletes it.
      *
      * @param string $name The name of the cookie to delete.
      * @param string $path The path on the server where the cookie will be available. Defaults to '/'.
@@ -42,15 +43,18 @@ public function deleteCookie(string $name, string $path = '/', string $domain =
     /**
      * Sets a cookie with the specified parameters.
      *
-     * This method uses PHP's `setcookie` function to set a cookie with the provided name, value, and various optional parameters such as expiration time, path, domain, security, and HttpOnly flags.
+     * This method uses PHP's `setcookie` function to set a cookie with the provided name, value, and various optional
+     * parameters such as expiration time, path, domain, security, and HttpOnly flags.
      *
      * @param string $name The name of the cookie.
      * @param string $value The value to store in the cookie.
      * @param int $expire The expiration time of the cookie, as a Unix timestamp. Defaults to 0 (session cookie).
      * @param string $path The path for which the cookie is valid. Defaults to '/'.
      * @param string $domain The domain for which the cookie is valid. Defaults to an empty string.
-     * @param bool $secure Whether the cookie should only be transmitted over secure (HTTPS) connections. Defaults to false.
-     * @param bool $httponly Whether the cookie should be accessible only via the HTTP protocol and not JavaScript. Defaults to true.
+     * @param bool $secure Whether the cookie should only be transmitted over secure (HTTPS) connections.
+     *                     Defaults to false.
+     * @param bool $httponly Whether the cookie should be accessible only via the HTTP protocol and not JavaScript.
+     *                       Defaults to true.
      * @return void
      */
     public function setCookie(
@@ -76,7 +80,8 @@ public function setCookie(
      * Redirects the user to the specified URL.
      *
      * This method sends an HTTP Location header to redirect the user to the provided URL and terminates the script.
-     * If the script is running in a testing environment (i.e., when TESTING is defined), a RuntimeException will be thrown instead of performing the redirect.
+     * If the script is running in a testing environment (i.e., when TESTING is defined), a RuntimeException will be
+     * thrown instead of performing the redirect.
      *
      * @param string $url The URL to redirect the user to.
      * @return void
@@ -109,11 +114,11 @@ public function render(string $content): string
      * This method encodes the provided data into a JSON format string, which
      * can be sent as a response in environments that expect JSON output.
      *
-     * @param array $data The data to be converted to a JSON string.
+     * @param array<string, mixed> $data The data to be converted to a JSON string.
      * @return string The JSON-encoded string representation of the data.
      */
     public function json(array $data): string
     {
-        return json_encode($data);
+        return !json_encode($data) ? "" : json_encode($data);
     }
 }
diff --git a/src/HelloResponse/HelloResponseInterface.php b/src/HelloResponse/HelloResponseInterface.php
index 9c09b9c..96a2473 100644
--- a/src/HelloResponse/HelloResponseInterface.php
+++ b/src/HelloResponse/HelloResponseInterface.php
@@ -24,8 +24,10 @@ public function setHeader(string $name, $value): void;
      * @param int $expire The expiration time of the cookie as a Unix timestamp. Default is 0 (session cookie).
      * @param string $path The path on the server where the cookie will be available. Default is '/'.
      * @param string $domain The domain that the cookie is available to. Default is an empty string.
-     * @param bool $secure Indicates if the cookie should only be transmitted over a secure HTTPS connection. Default is false.
-     * @param bool $httponly When true, makes the cookie accessible only through the HTTP protocol, restricting access from JavaScript. Default is true.
+     * @param bool $secure Indicates if the cookie should only be transmitted over a secure HTTPS connection.
+     *                     Default is false.
+     * @param bool $httponly When true, makes the cookie accessible only through the HTTP protocol, restricting access
+     *                       from JavaScript. Default is true.
      * @return void
      */
     public function setCookie(
@@ -65,8 +67,8 @@ public function redirect(string $url);
      * different frameworks or environments to implement their own mechanisms
      * for encoding and returning JSON data.
      *
-     * @param array $data The data to be converted to a JSON response.
-     * @return array The structured JSON response data.
+     * @param array<string, mixed> $data The data to be converted to a JSON response.
+     * @return string The string encoded JSON response data.
      */
     public function json(array $data): string;
 
diff --git a/src/Lib/AuthHelper.php b/src/Lib/AuthHelper.php
index 5cbfba8..43f3a5c 100644
--- a/src/Lib/AuthHelper.php
+++ b/src/Lib/AuthHelper.php
@@ -14,6 +14,11 @@ public function __construct(PKCE $pkce)
     {
         $this->pkce = $pkce;
     }
+
+    /**
+     * @param array<string, mixed> $config
+     * @return array<string, mixed>
+     */
     public function createAuthRequest(array $config): array
     {
         // Validate required parameters
@@ -28,20 +33,22 @@ public function createAuthRequest(array $config): array
             throw new InvalidArgumentException('redirect_uri is required in the authorization request.');
         }
 
-        $scopes = $config['scope'] ?? [];
-        if ($scopes && !$this->areScopesValid($scopes)) {
-            throw new InvalidArgumentException('One or more passed scopes are invalid.');
+        $scopes = $config['scope'] ?? Constants::$DEFAULT_SCOPE;
+        if (is_array($scopes)) {
+            if (!$this->areScopesValid($scopes)) {
+                throw new InvalidArgumentException('One or more passed scopes are invalid.');
+            }
+
+            // Add 'openid' and ensure uniqueness
+            $scopes = implode(' ', array_unique(array_merge($scopes, ['openid'])));
         }
 
-        // Add 'openid' and ensure uniqueness
-        $scopes = array_unique(array_merge($scopes ?? Constants::$DEFAULT_SCOPE, ['openid']));
         $nonce = $config['nonce'] ?? $this->generateUuid();
-
         // Prepare parameters
         $params = [
             'client_id'     => $clientId,
             'redirect_uri'  => $redirectUri,
-            'scope'         => implode(' ', $scopes),
+            'scope'         => $scopes,
             'response_type' => $config['response_type'] ?? Constants::$DEFAULT_RESPONSE_TYPE,
             'response_mode' => $config['response_mode'] ?? Constants::$DEFAULT_RESPONSE_MODE,
             'nonce'         => $nonce,
@@ -69,7 +76,7 @@ public function createAuthRequest(array $config): array
             $params['domain_hint'] = $domainHint;
         }
 
-        $wallet = $config['wallet'] ?? Constants::$PRODUCTION_WALLET;
+        $wallet = !isset($config['wallet']) ? Constants::$PRODUCTION_WALLET : $config['wallet'];
         $url = $wallet . Constants::$DEFAULT_PATH . '?' . http_build_query($params);
 
         return [
@@ -84,6 +91,10 @@ private function isValidScope(string $scope): bool
         return in_array($scope, Constants::getValidScopes(), true);
     }
 
+    /**
+     * @param array<string> $scopes
+     * @return bool
+     */
     private function areScopesValid(array $scopes): bool
     {
         foreach ($scopes as $scope) {
diff --git a/src/Lib/Crypto.php b/src/Lib/Crypto.php
index dbef6b9..66da349 100644
--- a/src/Lib/Crypto.php
+++ b/src/Lib/Crypto.php
@@ -11,14 +11,22 @@ class Crypto
 {
     private string $secret;
 
+    /**
+     * @throws InvalidSecretException
+     */
     public function __construct(string $secret)
     {
         if (!$this->checkSecret($secret)) {
             throw new InvalidSecretException();
         }
-        $this->secret = hex2bin($secret);
+        $bin = hex2bin($secret);
+        $this->secret = !$bin ? "" : $bin;
     }
 
+    /**
+     * @param array<string, mixed> $data
+     * @throws CryptoFailedException
+     */
     public function encrypt(array $data): string
     {
         $jsonData = json_encode($data);
@@ -38,6 +46,10 @@ public function encrypt(array $data): string
         return $this->uint8ArrayToUrlSafeBase64($encryptedData);
     }
 
+    /**
+     * @return array<string, mixed>|null
+     * @throws DecryptionFailedException
+     */
     public function decrypt(string $encryptedStr): ?array
     {
         try {
@@ -53,13 +65,15 @@ public function decrypt(string $encryptedStr): ?array
                 throw new DecryptionFailedException();
             }
 
-            return json_decode($decryptedData, true);
+            /** @var array<string, mixed>|null $jsonData */
+            $jsonData = json_decode($decryptedData, true);
+            return $jsonData;
         } catch (Exception $e) {
             throw new DecryptionFailedException();
         }
     }
 
-    public function checkSecret($secret): bool
+    public function checkSecret(string $secret): bool
     {
         if (!ctype_xdigit($secret) || strlen($secret) % 2 != 0) {
             return false;
@@ -76,7 +90,6 @@ private function uint8ArrayToUrlSafeBase64(string $binaryData): string
     private function urlSafeBase64ToUint8Array(string $base64String): string
     {
         $base64 = strtr($base64String, '-_', '+/');
-        $binaryData = base64_decode($base64 . str_repeat('=', (4 - strlen($base64) % 4) % 4));
-        return $binaryData;
+        return base64_decode($base64 . str_repeat('=', (4 - strlen($base64) % 4) % 4));
     }
 }
diff --git a/src/Lib/OIDCManager.php b/src/Lib/OIDCManager.php
index 66ecca9..433bc14 100644
--- a/src/Lib/OIDCManager.php
+++ b/src/Lib/OIDCManager.php
@@ -3,6 +3,8 @@
 namespace HelloCoop\Lib;
 
 use HelloCoop\Config\ConfigInterface;
+use HelloCoop\Exception\CryptoFailedException;
+use HelloCoop\Exception\DecryptionFailedException;
 use HelloCoop\Type\OIDC;
 use HelloCoop\HelloRequest\HelloRequestInterface;
 use HelloCoop\HelloResponse\HelloResponseInterface;
@@ -27,6 +29,9 @@ public function __construct(
         $this->crypto = $crypto;
     }
 
+    /**
+     * @throws DecryptionFailedException
+     */
     public function getOidc(): ?OIDC
     {
         $oidcCookie = $this->helloRequest->getCookie($this->config->getCookies()['oidcName']);
@@ -50,6 +55,9 @@ public function getOidc(): ?OIDC
         return null;
     }
 
+    /**
+     * @throws CryptoFailedException
+     */
     public function saveOidc(OIDC $oidc): void
     {
         try {
diff --git a/src/Lib/PKCE.php b/src/Lib/PKCE.php
index f73ce8c..f623b4b 100644
--- a/src/Lib/PKCE.php
+++ b/src/Lib/PKCE.php
@@ -14,7 +14,7 @@ public function generateVerifier(int $size = self::VERIFIER_LENGTH): string
     {
         $mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
         $result = "";
-        $randomBytes = random_bytes($size);
+        $randomBytes = random_bytes(max(1, $size));
 
         // Loop through each byte to generate a random character from the mask
         for ($i = 0; $i < $size; $i++) {
@@ -37,14 +37,12 @@ public function generateChallenge(string $code_verifier): string
         // Base64 URL encode the hash
         $encoded = base64_encode($hash);
         $encoded = rtrim($encoded, '=');
-        $encoded = str_replace(['/', '+'], ['_', '-'], $encoded);
-
-        return $encoded;
+        return str_replace(['/', '+'], ['_', '-'], $encoded);
     }
 
     /** Generate a PKCE challenge pair
      * @param int $length Length of the verifier (between 43-128). Defaults to 43.
-     * @return array A PKCE challenge pair containing 'code_verifier' and 'code_challenge'
+     * @return array<string, string> A PKCE challenge pair containing 'code_verifier' and 'code_challenge'
      */
     public function generatePkce(int $length = self::VERIFIER_LENGTH): array
     {
@@ -68,7 +66,9 @@ public function verifyChallenge(string $code_verifier, string $expectedChallenge
         return $actualChallenge === $expectedChallenge;
     }
 
-    // Generate a PKCE challenge pair
+    /** Generate a PKCE challenge pair
+     * @return array<string, string>
+     */
     public function generate(): array
     {
         $codeVerifier = self::generateVerifier();
diff --git a/src/Lib/TokenFetcher.php b/src/Lib/TokenFetcher.php
index 2cf48c3..601dc16 100644
--- a/src/Lib/TokenFetcher.php
+++ b/src/Lib/TokenFetcher.php
@@ -2,6 +2,7 @@
 
 namespace HelloCoop\Lib;
 
+use Exception;
 use HelloCoop\Config\Constants;
 use HelloCoop\Utils\CurlWrapper;
 
@@ -15,6 +16,11 @@ public function __construct(CurlWrapper $curl)
         $this->curl = $curl;
     }
 
+    /**
+     * @param array<string, string|null> $config
+     * @return string
+     * @throws Exception
+     */
     public function fetchToken(array $config): string
     {
         $code = $config['code'];
@@ -50,6 +56,7 @@ public function fetchToken(array $config): string
 
             $this->curl->close($ch);
 
+            /** @var array<string, mixed> $json */
             $json = json_decode($response, true);
 
             if ($httpCode !== 200) {
@@ -57,11 +64,11 @@ public function fetchToken(array $config): string
                 throw new \Exception($message);
             }
 
-            if (isset($json['error'])) {
+            if (isset($json['error']) && is_string($json['error'])) {
                 throw new \Exception($json['error']);
             }
 
-            if (!isset($json['id_token'])) {
+            if (!isset($json['id_token']) || !is_string($json['id_token'])) {
                 throw new \Exception('No id_token in response.');
             }
 
diff --git a/src/Lib/TokenParser.php b/src/Lib/TokenParser.php
index 99c8140..06f1311 100644
--- a/src/Lib/TokenParser.php
+++ b/src/Lib/TokenParser.php
@@ -4,6 +4,10 @@
 
 class TokenParser
 {
+    /**
+     * @param string $token
+     * @return array<string, mixed>
+     */
     public function parseToken(string $token): array
     {
         $parts = explode('.', $token);
@@ -35,7 +39,7 @@ public function parseToken(string $token): array
 
     private function base64UrlDecode(string $data): string
     {
-        $decodedData = strtr($data, '-_', '+/');
-        return base64_decode($decodedData, true);
+        $decodedData = base64_decode(strtr($data, '-_', '+/'), true);
+        return  !$decodedData ? "" : $decodedData ;
     }
 }
diff --git a/src/Renderers/DefaultPageRenderer.php b/src/Renderers/DefaultPageRenderer.php
index 1834cf3..64d4b2a 100644
--- a/src/Renderers/DefaultPageRenderer.php
+++ b/src/Renderers/DefaultPageRenderer.php
@@ -14,8 +14,9 @@ public function renderErrorPage(
         string $targetURI = '/'
     ): string {
         return <<<HTML
-<html>
+<html lang="en-US">
     <head>
+        <title>Hellō</title>
         <meta charset="UTF-8" />
         <style>
             body {
@@ -104,18 +105,99 @@ public function renderErrorPage(
      */
     public function renderSameSitePage(): string
     {
-        $info = $data['info'] ?? 'No additional information provided.';
+        // XXX: Is this needed?
+        // $info = $data['info'] ?? 'No additional information provided.';
 
         return <<<HTML
 <!DOCTYPE html>
-<html>
+<html lang="en-US">
     <head>
         <meta charset="utf-8"><title>Loading ...</title>
         <meta name="viewport" content="width=device-width, initial-scale=1">
     </head>
     <body>
         <div class="spinner"></div>
-        <script>const currentURL=window.location.href;const newURL=new URL(currentURL);newURL.searchParams.set('same_site','true');fetch(newURL).then(response=>response.json()).then(data=>{if(data&&data.target_uri){window.location=data.target_uri}else{console.error("No target_uri found -> /");window.location='/'} }).catch(error=>{console.error("An error occurred:",error);window.location='/' });</script><style>body{height:100%;min-width:320px;overflow-x:auto;overflow-y:hidden}body{font-family:sans-serif;display:flex;align-items:center;justify-content:center}.spinner{position:absolute;left:50%;top:50%;height:40px;width:40px;margin:-26px 0 0 -26px;box-sizing:content-box;animation:rotation 1s infinite linear;border-width:6px;border-style:solid;border-radius:100%}@keyframes rotation{from{transform:rotate(0deg)}to{transform:rotate(360deg)}}@media(prefers-color-scheme:dark){body{color:#d4d4d4;background:#151515;color-scheme:dark}.spinner{border-color:rgba(116,116,116,0.3);border-top-color:rgb(116,116,116)}}@media(prefers-color-scheme:light){body{color:#303030;background:white;color-scheme:light}.spinner{border-color:rgba(75,75,75,0.3);border-top-color:rgb(75,75,75)}}</style>
+        <script>
+            const currentURL=window.location.href;
+            const newURL=new URL(currentURL);
+            
+            newURL.searchParams.set('same_site','true');
+            fetch(newURL)
+                .then(response=>response.json())
+                .then(data=>{
+                    if(data && data.target_uri)
+                    {
+                        window.location=data.target_uri
+                    }
+                    else
+                    {
+                        console.error("No target_uri found -> /");
+                        window.location='/'
+                    }
+                })
+                .catch(
+                    error=>{
+                        console.error("An error occurred:",error);
+                        window.location='/'
+                    });
+        </script>
+        <style>
+            body {
+                height:100%;
+                min-width:320px;
+                overflow-x:auto;
+                overflow-y:hidden
+            }
+            body {
+                font-family:sans-serif;
+                display:flex;
+                align-items:center;
+                justify-content:center
+            }
+            .spinner {
+                position:absolute;
+                left:50%;
+                top:50%;
+                height:40px;
+                width:40px;
+                margin:-26px 0 0 -26px;
+                box-sizing:content-box;
+                animation:rotation 1s infinite linear;
+                border-width:6px;
+                border-style:solid;
+                border-radius:100%
+            }
+            @keyframes rotation {
+                from {
+                    transform:rotate(0deg)
+                }
+                to {
+                    transform:rotate(360deg)
+                }
+            }
+            @media (prefers-color-scheme:dark) {
+                body {
+                    color:#d4d4d4;
+                    background:#151515;
+                    color-scheme:dark
+                }
+                .spinner {
+                    border-color:rgba(116,116,116,0.3);
+                    border-top-color:rgb(116,116,116)
+                }
+            }
+            @media (prefers-color-scheme:light) {
+                body {
+                    color:#303030;
+                    background:white;
+                    color-scheme:light
+                }
+                .spinner {
+                    border-color:rgba(75,75,75,0.3);
+                    border-top-color:rgb(75,75,75)
+                }
+            }
+        </style>
     </body>
     </html>
 HTML;
@@ -128,11 +210,13 @@ public function renderSameSitePage(): string
      */
     public function renderRedirectURIBounce(): string
     {
-        $info = $data['info'] ?? 'No additional information provided.';
+        // XXX: Is this needed?
+        // $info = $data['info'] ?? 'No additional information provided.';
 
         return <<<HTML
-        <html>
+        <html lang="en-US">
             <head>
+                <title></title>
                 <script>
                     const baseURL = window.location.href.split("?")[0]
                     const searchParams = new URLSearchParams(window.location.search)
@@ -151,11 +235,13 @@ public function renderRedirectURIBounce(): string
      */
     public function renderWildcardConsole(string $uri, string $targetURI, string $appName, string $redirectURI): string
     {
-        $info = $data['info'] ?? 'No additional information provided.';
+        // XXX: Is this needed?
+        // $info = $data['info'] ?? 'No additional information provided.';
 
         return <<<HTML
-        <html>
+        <html lang="en-US">
             <head>
+                <title></title>
                 <meta charset="UTF-8" />
                 <style>
                     body {
diff --git a/src/Renderers/PageRendererInterface.php b/src/Renderers/PageRendererInterface.php
index 44545dc..b7ae03b 100644
--- a/src/Renderers/PageRendererInterface.php
+++ b/src/Renderers/PageRendererInterface.php
@@ -7,7 +7,12 @@ interface PageRendererInterface
     /**
      * Render an error page.
      */
-    public function renderErrorPage(string $error, string $errorDescription, string $errorURI, string $targetURI = '/'): string;
+    public function renderErrorPage(
+        string $error,
+        string $errorDescription,
+        string $errorURI,
+        string $targetURI = '/'
+    ): string;
 
     /**
      * Render a same-site page.
diff --git a/src/Type/Auth.php b/src/Type/Auth.php
index 3959d34..5f9d59b 100644
--- a/src/Type/Auth.php
+++ b/src/Type/Auth.php
@@ -17,8 +17,8 @@ public function __construct(bool $isLoggedIn, ?AuthCookie $authCookie = null, ?s
         $this->cookieToken = $cookieToken;
     }
 
-    /**
-     * Convert the instance to an array of key-value pairs.
+    /** Convert the instance to an array of key-value pairs.
+     * @return array<string, bool|string|array<string, mixed>|null>
      */
     public function toArray(): array
     {
@@ -29,8 +29,9 @@ public function toArray(): array
         ];
     }
 
-    /**
-     * Create an instance from an array of key-value pairs.
+    /** Create an instance from an array of key-value pairs.
+     * @param array<string, bool|string|array<string>|mixed|null>|null $data
+     * @return Auth
      */
     public static function fromArray(?array $data): self
     {
@@ -40,13 +41,19 @@ public static function fromArray(?array $data): self
         }
 
         // Create the AuthCookie instance from the array if it exists
-        $authCookie = isset($data['authCookie']) ? AuthCookie::fromArray($data['authCookie']) : null;
+        $authCookie = isset($data['authCookie']) && is_array($data['authCookie'])
+            ? AuthCookie::fromArray($data['authCookie'])
+            : null;
+
+        $cookieToken = isset($data['cookieToken']) && is_string($data['cookieToken'])
+            ? $data['cookieToken']
+            : null;
 
         // Return the new Auth instance
         return new self(
-            $data['isLoggedIn'],
+            is_bool($data['isLoggedIn']) ? $data['isLoggedIn'] : false,
             $authCookie,
-            $data['cookieToken'] ?? null
+            $cookieToken
         );
     }
 }
diff --git a/src/Type/AuthCookie.php b/src/Type/AuthCookie.php
index 3dd2356..e09c00d 100644
--- a/src/Type/AuthCookie.php
+++ b/src/Type/AuthCookie.php
@@ -8,13 +8,13 @@
 class AuthCookie extends Claims
 {
     /** @var int */
-    public $iat;
+    public int $iat;
 
     /**
      * @var array<string, mixed>
      * Allow arbitrary optional properties.
      */
-    public $extraProperties = [];
+    public array $extraProperties = [];
 
     public function __construct(string $sub, int $iat)
     {
@@ -24,6 +24,8 @@ public function __construct(string $sub, int $iat)
 
     /**
      * Add an extra property.
+     * @param string $key
+     * @param mixed $value
      */
     public function setExtraProperty(string $key, $value): void
     {
@@ -32,6 +34,7 @@ public function setExtraProperty(string $key, $value): void
 
     /**
      * Get an extra property.
+     * @return mixed
      */
     public function getExtraProperty(string $key)
     {
@@ -40,6 +43,7 @@ public function getExtraProperty(string $key)
 
     /**
      * Create an instance from an array of key-value pairs.
+     * @param array<string, int|string> $data
      */
     public static function fromArray(array $data): self
     {
@@ -47,7 +51,10 @@ public static function fromArray(array $data): self
             throw new InvalidArgumentException('Missing required keys "sub" or "iat".');
         }
 
-        $instance = new self($data['sub'], $data['iat']);
+        $instance = new self(
+            is_string($data['sub']) ? $data['sub'] : "",
+            is_int($data['iat']) ? $data['iat'] : 0
+        );
 
         foreach ($data as $key => $value) {
             if (!in_array($key, ['sub', 'iat'], true)) {
@@ -60,6 +67,7 @@ public static function fromArray(array $data): self
 
     /**
      * Convert the instance to an array of key-value pairs.
+     * @return array<string, mixed>
      */
     public function toArray(): array
     {
diff --git a/src/Type/AuthUpdates.php b/src/Type/AuthUpdates.php
index cf4586a..39cf4ce 100644
--- a/src/Type/AuthUpdates.php
+++ b/src/Type/AuthUpdates.php
@@ -2,22 +2,41 @@
 
 namespace HelloCoop\Type;
 
-class AuthUpdates extends Claims implements \ArrayAccess
+use ArrayAccess;
+
+/**
+ * @implements ArrayAccess<string, mixed>
+ */
+class AuthUpdates extends Claims implements ArrayAccess
 {
+    /** @var array<string, mixed> */
     private array $additionalProperties = [];
 
-    public function __construct(string $sub, int $iat, array $updates = [])
+    /**
+     * @param string $sub
+     * @param array<string, mixed> $updates
+     */
+    public function __construct(string $sub, array $updates = [])
     {
-        parent::__construct($sub, $iat);
+        parent::__construct($sub);
         $this->additionalProperties = $updates;
     }
 
-    // Magic methods for dynamic properties
+    /**
+     * Magic methods for dynamic properties
+     * @param string $name
+     * @param mixed $value
+     * @return void
+     */
     public function __set(string $name, $value): void
     {
         $this->additionalProperties[$name] = $value;
     }
 
+    /**
+     * @param string $name
+     * @return mixed|null
+     */
     public function __get(string $name)
     {
         return $this->additionalProperties[$name] ?? null;
@@ -41,7 +60,7 @@ public function offsetExists($offset): bool
 
     public function offsetGet($offset): ?string
     {
-        return $this->additionalProperties[$offset] ?? null;
+        return is_string($this->additionalProperties[$offset]) ? $this->additionalProperties[$offset] : null;
     }
 
     public function offsetSet($offset, $value): void
@@ -54,6 +73,9 @@ public function offsetUnset($offset): void
         unset($this->additionalProperties[$offset]);
     }
 
+    /**
+     * @return array<string, mixed>
+     */
     public function toArray(): array
     {
         return array_merge(get_object_vars($this), $this->additionalProperties);
diff --git a/src/Type/Claims.php b/src/Type/Claims.php
index 5ca36ea..3eb6c01 100644
--- a/src/Type/Claims.php
+++ b/src/Type/Claims.php
@@ -13,7 +13,7 @@ class Claims
     use OptionalOrgClaimTrait;
 
     /** @var string */
-    public $sub;
+    public string $sub;
 
     public function __construct(string $sub)
     {
diff --git a/src/Type/Common/OptionalAccountClaimsTrait.php b/src/Type/Common/OptionalAccountClaimsTrait.php
index 27c866b..fcf037b 100644
--- a/src/Type/Common/OptionalAccountClaimsTrait.php
+++ b/src/Type/Common/OptionalAccountClaimsTrait.php
@@ -8,5 +8,5 @@ trait OptionalAccountClaimsTrait
      * @var array<string, array{id: string, username: string}>
      * An associative array of account claims (e.g., ['github' => ['id' => '123', 'username' => 'user']]).
      */
-    public $claims = [];
+    public array $claims = [];
 }
diff --git a/src/Type/Common/OptionalOrgClaimTrait.php b/src/Type/Common/OptionalOrgClaimTrait.php
index 6bef94c..8d70a71 100644
--- a/src/Type/Common/OptionalOrgClaimTrait.php
+++ b/src/Type/Common/OptionalOrgClaimTrait.php
@@ -8,5 +8,5 @@ trait OptionalOrgClaimTrait
      * @var array{id: string, domain: string}|null
      * Optional organization claim.
      */
-    public $org;
+    public ?array $org;
 }
diff --git a/src/Type/Common/OptionalStringClaimsTrait.php b/src/Type/Common/OptionalStringClaimsTrait.php
index d86c8f9..d35623d 100644
--- a/src/Type/Common/OptionalStringClaimsTrait.php
+++ b/src/Type/Common/OptionalStringClaimsTrait.php
@@ -4,13 +4,13 @@
 
 trait OptionalStringClaimsTrait
 {
-    public $name;
-    public $nickname;
-    public $preferred_username;
-    public $given_name;
-    public $family_name;
-    public $email;
-    public $phone;
-    public $picture;
-    public $ethereum;
+    public string $name;
+    public string $nickname;
+    public string $preferred_username;
+    public string $given_name;
+    public string $family_name;
+    public string $email;
+    public string $phone;
+    public string $picture;
+    public string $ethereum;
 }
diff --git a/src/Type/OIDC.php b/src/Type/OIDC.php
index 235511d..06c6c73 100644
--- a/src/Type/OIDC.php
+++ b/src/Type/OIDC.php
@@ -19,6 +19,10 @@ public function __construct(string $codeVerifier, string $nonce, string $redirec
         $this->targetUri = $targetUri;
     }
 
+    /**
+     * @param array<string, mixed> $data
+     * @return self
+     */
     public static function fromArray(array $data): self
     {
         if (!isset($data['code_verifier'])) {
@@ -45,6 +49,9 @@ public static function fromArray(array $data): self
         );
     }
 
+    /**
+     * @return array<string, string>
+     */
     public function toArray(): array
     {
         return [
diff --git a/src/Utils/CurlWrapper.php b/src/Utils/CurlWrapper.php
index 81a4545..48964e7 100644
--- a/src/Utils/CurlWrapper.php
+++ b/src/Utils/CurlWrapper.php
@@ -2,35 +2,63 @@
 
 namespace HelloCoop\Utils;
 
+// XXX: phpstan ignores can be removed when 7.x support is dropped in library.
 class CurlWrapper
 {
+    /**
+     * @param string $url
+     * @return false|resource
+     */
     public function init(string $url)
     {
         return curl_init($url);
     }
 
+    /**
+     * @param resource $ch
+     * @param int $option
+     * @param mixed $value
+     * @return bool
+     */
     public function setOpt($ch, int $option, $value): bool
     {
-        return curl_setopt($ch, $option, $value);
+        return curl_setopt($ch, $option, $value); // @phpstan-ignore argument.type
     }
 
+    /**
+     * @param resource $ch
+     * @return bool|string
+     */
     public function exec($ch)
     {
-        return curl_exec($ch);
+        return curl_exec($ch); // @phpstan-ignore argument.type
     }
 
+    /**
+     * @param resource $ch
+     * @param int $option
+     * @return mixed
+     */
     public function getInfo($ch, int $option)
     {
-        return curl_getinfo($ch, $option);
+        return curl_getinfo($ch, $option); // @phpstan-ignore argument.type
     }
 
+    /**
+     * @param resource $ch
+     * @return void
+     */
     public function close($ch): void
     {
-        curl_close($ch);
+        curl_close($ch); // @phpstan-ignore argument.type
     }
 
+    /**
+     * @param resource $ch
+     * @return string
+     */
     public function error($ch): string
     {
-        return curl_error($ch);
+        return curl_error($ch); // @phpstan-ignore argument.type
     }
 }
diff --git a/src/Utils/HelloString.php b/src/Utils/HelloString.php
index 206337f..608aad0 100644
--- a/src/Utils/HelloString.php
+++ b/src/Utils/HelloString.php
@@ -1,14 +1,14 @@
 <?php
 
-namespace HelloCoop\Tests\Utils;
+namespace HelloCoop\Utils;
 
 class HelloString
 {
-    public static function startsWith($haystack, $needle)
+    public static function startsWith(string $haystack, string $needle): bool
     {
         return substr_compare($haystack, $needle, 0, strlen($needle)) === 0;
     }
-    public static function endsWith($haystack, $needle)
+    public static function endsWith(string $haystack, string $needle): bool
     {
         return substr_compare($haystack, $needle, -strlen($needle)) === 0;
     }
diff --git a/src/Utils/QueryParamFetcher.php b/src/Utils/QueryParamFetcher.php
index 616f8e6..be81398 100644
--- a/src/Utils/QueryParamFetcher.php
+++ b/src/Utils/QueryParamFetcher.php
@@ -4,6 +4,10 @@
 
 class QueryParamFetcher
 {
+    /**
+     * @param array<string, mixed> $keys
+     * @return array<string, mixed>
+     */
     public static function fetch(array $keys): array
     {
         $result = [];