Weave Code
Lara Verifactu Laravel Package
aichadigital/lara-verifactu
Laravel package for Spain's Verifactu invoice compliance system: generate, sign, and send tamper-proof invoices to the AEAT, manage QR codes, hash chains, and validation records from your PHP app with a simple, framework-native API.
Laravel package for AEAT Verifactu compliance with agnostic architecture
Frequently asked questions about Lara Verifactu
- How do I install aichadigital/lara-verifactu in a Laravel app?
- Install it with Composer using aichadigital/lara-verifactu, then publish the package's config file and run any migrations it ships so the hash chain and validation records have somewhere to live. After that you register your AEAT certificate and taxpayer details in the configuration. The exact artisan commands and published file paths are listed in the README on the GitLab repository, since the GitHub repo is only a distribution mirror.
- Which Laravel and PHP versions does lara-verifactu support?
- The authoritative answer is the require block in the package's composer.json, so check it before you plan an upgrade. Verifactu is a recent Spanish regulation and the package targets currently supported Laravel releases and modern PHP versions rather than legacy frameworks. If you are pinned to an older Laravel version, confirm compatibility in the GitLab repository before adopting it.
- Does lara-verifactu generate the QR code that Verifactu requires on invoices?
- Yes, QR generation is part of the package's scope, so it builds the Verifactu-compliant QR payload containing the validation URL, issuer NIF, invoice number, date and total. You still render that payload as an image on your printed or PDF invoice using a QR library of your choice. Keep the QR in sync with the record you actually submit, because the two are cross-checked.
- How does the Verifactu hash chain work and what can break it?
- Each Verifactu record must include the hash, or huella, of the previous record, which forms a chained and tamper-evident ledger. The package generates those hashes and links records in sequence before persisting the validation record. The practical risk is concurrency: if two invoices are issued at the same moment you must serialise the chain, so wrap issuance in a database transaction or a lock so the previous hash is read consistently.
- Can I test against the AEAT sandbox before sending real invoices?
- Verifactu defines separate AEAT endpoints for preproduction and production, and the package exposes that as configuration. Point it at the test endpoint and sign with a test certificate so you can exercise the full submit-and-validate flow without filing live invoices. For your own test suite, bind a fake or mock in place of the AEAT client so tests never hit the network.
- What certificate do I need to sign invoices for Verifactu?
- You need a qualified electronic certificate issued to the invoicing entity, from FNMT or another recognised issuer, in order to sign records for Verifactu. Store the certificate file and its password outside the repository, using environment variables or a secrets manager, and load them through the package configuration. Certificates expire, so build in a renewal reminder before submissions start being rejected.
- Is lara-verifactu safe to use in production?
- Weigh a few things before going live: the GitHub mirror runs no CI and accepts no pull requests, so you are trusting the upstream GitLab pipeline for quality. On your side, secure the signing certificate, make submissions idempotent and queue them so an AEAT outage does not block invoicing, and persist every AEAT response as a validation record. Also confirm how the package behaves on rejection, because Verifactu expects records to be retained and retried rather than deleted.
- Where do I report a bug or send a pull request for lara-verifactu?
- The GitHub repository is a read-only distribution mirror, with issues, pull requests and CI disabled. Development happens at gitlab.castris.com/aichadigital/lara-verifactu, so bug reports and merge requests belong there. If you are auditing the code, the GitLab repository is also where the current source and commit history live.
- What alternatives are there to lara-verifactu for Verifactu in PHP?
- Alternatives fall into two camps: other PHP Verifactu libraries and SDKs from Spanish vendors, or writing your own SOAP client against AEAT's Verifactu web services. A standalone SDK is fine if you are not on Laravel, but you will end up rebuilding configuration, migrations, queued jobs and Eloquent models for the hash chain yourself. If you are staying on Laravel and want framework-native config, events and persistence, this package is the more direct fit.
- Does lara-verifactu create invoices, or only handle the AEAT side?
- The package handles the Verifactu compliance layer: building the record, computing the hash chain, signing, generating the QR, submitting to AEAT and persisting validation responses. It does not replace your billing or ERP system, so you still own customers, invoice lines, numbering and PDF rendering, and pass that data in. Treat it as the compliance adapter between your domain models and AEAT.
Weaver
How can I help you explore Laravel packages today?