alfasix / alfakit-webhooks

v0.2.5 2026-10-27 12:29 UTC

Requires

• php: ^8.4
• alfasix/alfakit: ^0.2|@dev

MIT

• Alfa Six

• events
• laravel
• hmac
• webhooks
• integrations
• alfakit

Published on Packagist.org on 2026-10-29 13:41 UTC

README

_{by Alfa Six}

This is a read-only split of the AlfaKit monorepo. Please open issues and pull requests there.

Outgoing webhooks managed in an AlfaKit panel. Your users add endpoints and pick the events they want; your code dispatches events; the plugin delivers them queued, signed with HMAC-SHA256, retried with exponential backoff, logged (redacted) with replay, and protected against SSRF. It renders in React, Vue and Svelte with AlfaKit's built-in components and has no dependencies beyond Laravel.

Installation

composer require alfasix/alfakit-webhooks
php artisan vendor:publish --tag=alfakit-webhooks-migrations
php artisan migrate

Run a queue worker, and schedule Schedule::command('alfakit-webhooks:prune')->daily();.

Register

use AlfaSix\AlfakitWebhooks\WebhooksPlugin;

$panel->plugin(
    WebhooksPlugin::make()
        ->events([
            'order.paid' => 'Order paid',
            'order.refunded' => 'Order refunded',
        ])
        ->modelEvents([Customer::class]) // customer.created, customer.updated, customer.deleted
        ->authorize(fn (User $user): bool => $user->is_admin),
);

Dispatch

use AlfaSix\AlfakitWebhooks\Webhooks;

Webhooks::dispatch('order.paid', ['order' => $order->only(['id', 'total'])]);

Verify (receiver)

[$t, $v1] = /* parse "t=…,v1=…" from the X-Webhook-Signature header */;
$valid = abs(time() - $t) <= 300
    && hash_equals(hash_hmac('sha256', $t.'.'.$request->getContent(), $secret), $v1);

The documentation covers every option, the signature scheme with PHP and Node.js receivers, retries, auto-disable, tenancy, authorisation and the SSRF protection.

License

MIT. See LICENSE.md.