Open source
Webhooks for Laravel
composer require roundly-consulting/webhooks-for-laravelOverview
Receive signed webhooks from any sender and send signed webhooks your customers can verify. Inbound deliveries are verified, deduplicated and handed to a queued handler once; outbound deliveries follow the open Standard Webhooks format and are signed, retried with backoff, throttled per endpoint and SSRF-guarded — with a delivery log for both directions, secret rotation and replay. MIT-licensed, it runs on your own queue and database, built only on Laravel’s components and the Roundly packages for security, rate limits and safe outbound requests.
What you get
Receive from any sender
One endpoint per sender with an unguessable URL and a secret shown once. Every request is checked for size, content type, signature, freshness and duplicates, then stored and handed to a queued handler — once.
Send signed webhooks
Webhooks::send() and broadcast() deliver a signed envelope to your customers’ endpoints — subscriptions with wildcards, idempotent sends, nothing sent when the transaction rolls back.
Standard Webhooks, RFC 9421 or your own
The open Standard Webhooks format by default, HTTP message signatures (RFC 9421) through Sentinel, and custom schemes — webhooks:make-scheme writes a GitHub- or Stripe-style one into your app.
Retries that behave
8 attempts over about 24 hours with exponential backoff and jitter, Retry-After honoured, a per-endpoint throttle, auto-disable after sustained failure or a 410, and redelivery of everything that failed.
SSRF-guarded by default
Customer URLs go through Safe Fetch on save and on every attempt: https only, private, loopback and cloud-metadata addresses refused, DNS pinned, redirects off or re-vetted per hop.
Delivery log without secrets
Both directions logged — status, attempts, response codes, timings, errors — with encrypted payloads, a sanitizer, retention, JSON resources, replay and secret rotation with a grace period.
Facade, DI or actions
One Webhooks facade, an injectable manager or single-purpose actions — plus a recording fake, signed test requests in any scheme and a DNS table for outbound tests.
Documentation
Use cases
Where the package fits — SaaS teams offering webhooks to their customers, and apps consuming payment, source-control, e-signature or CRM webhooks.
Installation
Install via Composer, publish config and migrations with webhooks:install, migrate, then run a queue worker and the scheduler.
Configuration
Every key of config/webhooks.php — keys and models, queues, the inbound pipeline, outbound delivery, SSRF, secrets, schemes, payloads and the schedule.
The Webhooks facade
Tour the Webhooks facade — send, broadcast, for($owner), the inbound() and outbound() sub-accessors, the scheme and handler registries, prune and fake.
DI and actions
Skip the facade: inject WebhooksManager or call a single-purpose action — every action with its execute() signature and facade method.
Receiving webhooks
Inbound endpoints, the fixed-order pipeline and its status codes, replay protection and idempotency, and mounting the route yourself.
Handlers and processing
Bind handler classes or closures by alias, read the payload, headers and owner, process once per delivery on the queue, and replay stored deliveries.
Sending webhooks
Outbound endpoints with subscriptions and custom headers, send, idempotent sends, broadcast, events that broadcast themselves, ping and the envelope.
Delivery and retries
One attempt step by step, the retry schedule, the per-endpoint throttle, auto-disable, redelivery and resending everything after an outage.
Managing endpoints
Find, list, update, clear, enable, disable and delete endpoints in both directions, the HasWebhooks owner trait and every option limit.
Signature schemes
The default Standard Webhooks v1 scheme byte for byte with test vectors, RFC 9421 HTTP message signatures, and custom GitHub- or Stripe-style schemes.
Guide for receivers
A page to hand your customers: what arrives, the raw body per stack, verification in PHP, Node, Python, Go and Ruby, test vectors and what to answer.
Secrets and rotation
Generated and imported secrets, encryption at rest, shown-once DTOs, rotation with a grace period in both directions, and what deleting wipes.
Outbound safety (SSRF)
How Safe Fetch guards every customer URL on save and on every attempt — the policy, DNS pinning, redirects and local development.
Payloads and retention
Inbound payloads as untrusted input, the sanitizer and how to replace it, encryption at rest, and retention with webhooks:prune and a dry run.
Delivery log and resources
Swappable models and their helpers, querying the log in both directions, the JSON resources for your own screens and the owner reference.
Events
Seven events for your audit log — received, rejected, processing failed, delivered, failed, endpoint disabled, secret rotated — and how to listen safely.
Artisan commands
Install, the doctor and its checks, the retry sweep, prune, rotate, redeliver, replay, list, enable, ping and make-scheme — plus the schedule and about.
Testing
Webhooks::fake() with every assertion and its negative, SignedWebhookRequest for inbound tests in any scheme, factories and FakeHostResolver for DNS.
Threat model
What the package defends against and how — forgery, replay, enumeration, exhaustion, SSRF, secret disclosure — and what it deliberately does not.
Requirements
PHP 8.4+, Laravel 13, ext-curl and ext-json, MySQL or PostgreSQL, a queue worker and the scheduler, and the Roundly packages it builds on.
Show your open-source love
This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.
More ways to support, including cryptoBy donating, you agree to our donation terms.
Want this built into your product?
We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.