monkeyscloud / monkeyslegion-webhooks

1.0.2 2026-09-29 01:49 UTC

Requires

• php: ^8.4
• ext-curl: *
• ext-pdo: *
• monkeyscloud/monkeyslegion-http: ^2.1
• psr/http-message: ^2.0
• psr/http-server-handler: ^1.0
• psr/http-server-middleware: ^1.0

Requires (Dev)

• phpunit/phpunit: ^11.0

MIT

Published on Packagist.org on 2026-09-29 01:49 UTC

README

Outgoing and incoming webhook system for the MonKeysLegion framework.

Features

• HMAC-SHA256 signing — secure webhook payload verification
• Outgoing webhooks — register, dispatch, and track deliveries
• Incoming webhook verification — PSR-15 middleware
• Retry with exponential backoff — configurable max retries
• Delivery tracking — success, failed, retrying, pending statuses
• Multiple drivers — InMemory (testing), Database (PDO)

Installation

composer require monkeyscloud/monkeyslegion-webhooks

Usage

Outgoing Webhooks

use MonkeysLegion\Webhooks\WebhookManager;

$manager = $container->get(WebhookManager::class);

// Register a webhook endpoint
$manager->register('orders.created', 'https://example.com/webhook', 'secret');

// Dispatch an event to all matching webhooks
$manager->dispatch('orders.created', ['order_id' => 123, 'total' => 99.99]);

Incoming Webhook Verification

// In your routes
#[Route('POST', '/webhook/stripe')]
#[Middleware(['webhook.verify:stripe'])]
public function handleStripe(ServerRequestInterface $request): Response
{
    $payload = $request->getParsedBody();
    // Payload is already verified
}

Manual Signature Verification

use MonkeysLegion\Webhooks\WebhookSigner;

$signer = new WebhookSigner('your-secret');
$signature = $signer->sign($payload);

if ($signer->verify($payload, $signature)) {
    // Verified!
}

License

MIT © MonKeysCloud