pushery/webhooks-for-laravel

An all-in-one, config-gated webhooks toolkit for Laravel: send signed outbound webhooks (Standard Webhooks signatures by default, Ed25519 optional), receive and verify inbound ones, let customers self-serve their endpoints, and observe every delivery on a dashboard — switch on only the layers you ne

v1.8.0 2026-08-03 15:53 UTC

Requires

• php: ^8.4
• ext-curl: *
• ext-json: *
• ext-sodium: *
• guzzlehttp/guzzle: ^7.15.1
• guzzlehttp/psr7: ^2.7
• illuminate/console: ^13.0
• illuminate/contracts: ^13.0
• illuminate/database: ^13.0
• illuminate/support: ^13.0
• laravel/framework: ^13.0
• opis/json-schema: ^2.6
• psr/http-message: ^2.0

Suggests

• blade-ui-kit/blade-heroicons: The icon set the shipped screens are drawn against (WireKit's default preset).
• blade-ui-kit/blade-icons: Renders the icons the shipped screens ask WireKit for (empty states, primary actions). Without it WireKit draws an inert placeholder in their place.
• laravel/pulse: Enables the opt-in internal-ops delivery monitor (Webhooks\Pulse\WebhookPulseServiceProvider) — a Pulse recorder and card for throughput, failure rate and latency.
• laravel/scout: Enables the opt-in searchable delivery and inbound-call logs (use the ready-made Webhooks\Search\SearchableWebhookDelivery / SearchableWebhookCall models — or apply the Webhooks\Search\SearchableDelivery / SearchableCall traits to your own — and set webhooks.search.enabled).
• livewire/livewire: Required to render any UI this package ships: the observability dashboard, the self-service endpoint portal, and the optional management components (Webhooks\WebhooksUiServiceProvider).
• pushery/wirekit: Required to render the dashboard and the self-service portal AS SHIPPED — their views are built from WireKit components. A host on another UI kit must publish the views (--tag=webhooks-dashboard-views / --tag=webhooks-self-service-views) and restyle them instead.

MIT

• mysql
• postgres
• laravel
• hmac
• webhooks
• ssrf
• Ed25519
• livewire
• standard-webhooks
• webhook-delivery
• webhook-signing

Published on Packagist.org on 2026-08-03 15:53 UTC

README

Webhooks for Laravel

An all-in-one, config-gated webhooks toolkit for Laravel. It sends signed outbound webhooks, receives and verifies inbound ones, gives your customers a self-service portal to manage their own endpoints, and puts an observability dashboard over the whole delivery log — and you switch on only the layers you need. Signatures are Standard Webhooks by default, so every delivery is verifiable out of the box by any Standard Webhooks consumer in any language. The engine is entirely in-house — no third-party webhook-engine dependency — and its storage runs on PostgreSQL or MySQL 8.4+ (or on no database at all, if you only send).

composer require pushery/webhooks-for-laravel

Documentation

Full documentation lives at docs.pushery.com/webhooks-for-laravel.

• Installation — requirements, the per-layer publish tags, and the packages the UI needs
• Quickstart — send a signed webhook, receive and verify one, or run send-only with no database
• Choosing your database — the three topologies, and what PostgreSQL buys over MySQL
• The layers — sending, receiving, subscriptions and fan-out, the portal, the dashboard, the operator console
• Signatures and interop — the wire format, every shipped scheme, and the published known-answer vectors
• Configuration reference — every section, gate and default

What you get

• Sending — an immutable, fluent PendingWebhook builder: signed and queued, exponential backoff with full jitter, Retry-After honored off the retry budget, per-call timeouts, mutual TLS, secret rotation and Horizon tags.
• Receiving — verify, throttle, de-duplicate, store and dispatch, with the exact received bytes preserved. Adapters ship for Standard Webhooks, Stripe, GitHub and plain HMAC, plus a seam for providers that authenticate without a signature at all.
• Subscriptions and fan-out — register endpoints per event type, fan an event out to every matching subscription, with an optional event catalog, JSON Schema payload validation and prefix wildcards.
• A self-service portal — real, full-page screens where a customer manages its own endpoints, rotates its signing secret and inspects endpoint health.
• An observability dashboard — KPI cards, latency percentiles, a server-rendered activity chart, a filterable delivery table with one-click redelivery, and an optional JSON metrics endpoint.
• Reliability — a circuit breaker that auto-disables a dead endpoint, traffic-shaping rate limits, and retention that drops a partition on PostgreSQL and runs a chunked, indexed delete on MySQL.
• Security by default — every outbound URL is SSRF-vetted and the connection pinned to the validated IP, secrets are encrypted at rest, and sensitive inbound headers are redacted before storage.
• Seven languages — every string the shipped UI renders is translated, and the translations are publishable.

Each layer has a single switch, so you pay only for what you turn on. A send-only app runs no migrations at all and needs no database.

Requirements

• PHP 8.4+ with ext-curl, ext-json, ext-sodium
• Laravel 13+
• PostgreSQL 13+ or MySQL 8.4+ — for the layers that persist
• A queue worker for outbound delivery
• livewire/livewire and pushery/wirekit for the shipped UI screens

Security

Report vulnerabilities privately, per the security policy.

Built by Pushery

This package is built and maintained by Pushery — a Berlin-based studio building Laravel applications, SaaS products, and open-source tools.

Building a Laravel UI? WireKit, Pushery's open-source Livewire component kit, gives you a polished component library out of the box. Browse the rest of our work at pushery.com.

License

The MIT License (MIT). See LICENSE for details.