subdomainto/laravel

Laravel package for the subdomain.to custom domains API with an injectable client, facade, configuration, and signed webhook middleware.

v1.0.1 2026-07-29 12:32 UTC

Requires

• php: ^8.2
• guzzlehttp/guzzle: ^7.8
• guzzlehttp/psr7: ^2.6
• illuminate/contracts: ^12.0 || ^13.0
• illuminate/http: ^12.0 || ^13.0
• illuminate/support: ^12.0 || ^13.0
• subdomainto/sdk: ^1.0

Requires (Dev)

• orchestra/testbench: ^10.0 || ^11.0
• phpunit/phpunit: ^11.0 || ^12.0

MIT

• middleware
• dns
• laravel
• ssl
• saas
• tls
• webhooks
• custom-domains
• domain-management

Published on Packagist.org on 2026-07-29 13:28 UTC

README

subdomainto/laravel adds the subdomain.to custom domains API to Laravel applications. It registers the typed PHP client in the service container, provides an optional facade, publishes configuration, and includes middleware for signed webhook verification.

The package supports Laravel 12 and 13 on PHP 8.2 or later.

Installation

composer require subdomainto/laravel
php artisan vendor:publish --tag=subdomainto-config

Configure server-side credentials:

SUBDOMAINTO_API_KEY=sdt_live_xxxxxxxxxxxxxxxxxxxxxxxx
SUBDOMAINTO_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxxxxx
SUBDOMAINTO_WEBHOOK_TOLERANCE=300

Inject the custom domains client

use SubdomainTo\Client;
use SubdomainTo\Model\Domain;

final class ConnectCustomerDomain
{
    public function __construct(private Client $subdomainTo) {}

    public function handle(string $customerId, string $hostname): Domain
    {
        return $this->subdomainTo->domains()->create(
            $hostname,
            $customerId.'-domain',
        );
    }
}

The client exposes typed resources for destinations, domains, DNS and TLS lifecycle status, webhooks, widget sessions, usage, and billing. You can also use the SubdomainTo facade in commands, jobs, and prototypes.

Protect a webhook route

use Illuminate\Support\Facades\Route;

Route::post('/webhooks/subdomainto', SubdomainToWebhookController::class)
    ->middleware('subdomainto.webhook');

The middleware verifies the untouched request body, SubdomainTo-Signature, HMAC signature, and timestamp before placing the verified event on the subdomainto_event request attribute.

Documentation

Read the Laravel SDK guide, browse the custom domains API documentation, or report an issue in the GitHub repository.

License

MIT