README

Webhooks for Laravel

Receive signed webhooks from any sender and send signed webhooks your customers can verify. Inbound deliveries are verified, deduplicated and handed to a queued handler exactly once; outbound deliveries are signed, retried with backoff, throttled per endpoint and SSRF-guarded — with a full delivery log, secret rotation and replay.

Installation

Requires PHP 8.4, Laravel 13 and ext-curl.

composer require roundly-consulting/webhooks-for-laravel
php artisan webhooks:install
php artisan migrate

webhooks:install publishes the config and the migrations (with sentinel's idempotency store). A queue worker must run — deliveries are processed only on the queue — and the scheduler, which runs webhooks:retry every minute.

Usage

Receive: one endpoint per sender. Give the sender the URL and the secret — it is shown once.

use RoundlyConsulting\Webhooks\Facades\Webhooks;

$inbound = Webhooks::for($team)->inbound()->create(handler: 'billing');
$inbound->url;     // https://app.test/webhooks/q8Zr…  (an unguessable 32-character key)
$inbound->secret;  // whsec_…  — never readable again

Bind the handler alias in config/webhooks.php ('handlers' => ['billing' => BillingWebhookHandler::class]):

use RoundlyConsulting\Webhooks\Contracts\InboundHandler;
use RoundlyConsulting\Webhooks\DataTransferObjects\InboundWebhook;

final class BillingWebhookHandler implements InboundHandler
{
    public function handle(InboundWebhook $webhook): void
    {
        if ($webhook->type === 'invoice.paid') {
            // runs on the queue, once per delivery
        }
    }
}

Send: signed, retried, throttled and SSRF-guarded.

$outbound = Webhooks::for($team)->outbound()->create('https://example.com/webhooks', events: ['invoice.*']);
$outbound->secret; // whsec_… — hand it to the receiver once

Webhooks::send($outbound->endpoint, 'invoice.paid', ['invoice' => 42]);

Documentation

The full documentation — configuration, every feature and its API, and testing — lives on our website: roundly-consulting.com/open-source/docs/webhooks-for-laravel

Release notes are in CHANGELOG.md. To contribute, see the contributing guide.

Support our work

This package is free and open source, built and maintained by Roundly Consulting. If it saves you time, please consider supporting our open-source work — a one-time donation, a monthly pledge on Patreon or a crypto donation helps fund maintenance, new features and new packages.

License

The MIT License (MIT). See LICENSE.md.

roundly-consulting / webhooks-for-laravel

Package info

Security

Fund package maintenance!

Statistics