Webhook routes

The bundled webhook route is disabled by default. Enable it and the package registers POST {prefix}/webhooks/{provider} (route name purchases.webhooks), which verifies, records, fires events and returns 204 No Content:

PURCHASES_ROUTES_ENABLED=true
PURCHASES_ROUTES_PREFIX=purchases

• 204 — verified and recorded (or queued).
• 400 — signature or credential verification failed, or a Google push wasn’t authenticated.
• 404 — no provider is registered under that id.

Point each store’s server notifications at its URL:

POST https://your-app.test/purchases/webhooks/apple
POST https://your-app.test/purchases/webhooks/google
POST https://your-app.test/purchases/webhooks/stripe

Customising the route

routes.prefix and routes.middleware shape the route; the default api middleware group carries no CSRF check. For full control, publish the routes file with the purchases-routes tag, or call Purchases::handle() from your own controller — see The Purchases facade:

// config/purchases.php
'routes' => [
    'enabled' => env('PURCHASES_ROUTES_ENABLED', false),
    'prefix' => env('PURCHASES_ROUTES_PREFIX', 'purchases'),
    'middleware' => ['api'],
],