Webhook routes

The bundled webhook route is disabled by default, and only an explicit on value enables it: a switch that is not set (missing from a partly published routes array, null, blank or an unset env var) keeps it off — up to 1.1.8 such a switch loaded it. Enable it and the package registers POST {prefix}/webhooks/{provider} (route name purchases.webhooks), which verifies, records, fires events and returns 204 No Content:

PURCHASES_ROUTES_ENABLED=true
PURCHASES_ROUTES_PREFIX=purchases

• 204 — verified and recorded (or queued), or only audited — an informational notification, a Google RTDN for another app.
• 400 — signature or credential verification failed, a Google push wasn’t authenticated, an Apple request carried no signedPayload string, or a Google RTDN named a . or .. token.
• 404 — no provider is registered under that id.
• 500 — a store read during verification failed (a Google subscription read with any error but 410, Stripe’s Invoice Payments lookup) or the store was unreachable. The store redelivers.

Point each store’s server notifications at its URL:

POST https://your-app.test/purchases/webhooks/apple
POST https://your-app.test/purchases/webhooks/google
POST https://your-app.test/purchases/webhooks/stripe

The route takes signed store events only. Verify a client’s Google purchase token or Stripe redirect from your own route with callback() — see Client callbacks.

Customising the route

routes.prefix and routes.middleware shape the route; the default api middleware group carries no CSRF check. For full control, publish the routes file with the purchases-routes tag, or call Purchases::handle() from your own controller — see The Purchases facade:

// config/purchases.php
'routes' => [
    'enabled' => env('PURCHASES_ROUTES_ENABLED', false),
    'prefix' => env('PURCHASES_ROUTES_PREFIX', 'purchases'),
    'middleware' => ['api'],
],