- How do I install asvae/laravel-api-tester in a Laravel application?
- Install it as a dev dependency with Composer (composer require --dev asvae/laravel-api-tester), then publish its config and front-end assets and register the middleware or gate that protects the tester route. The package registers a route inside your own Laravel app rather than running as a separate service, so there is nothing else to host. On a current Laravel and PHP version, expect the install to fail on version constraints first; you may need a fork or a VCS repository alias before installation succeeds.
- Which Laravel and PHP versions does laravel-api-tester support?
- The last upstream release dates from September 2020, which is the Laravel 8 era, so the published composer.json constraints target older framework and PHP versions. A Laravel 9, 10, or 11 application on PHP 8.2+ will generally not resolve against those constraints without modification. Treat version support as something you own via a fork rather than something upstream provides.
- Is laravel-api-tester safe to use in production?
- No, not by default. The tool sends arbitrary payloads to arbitrary application routes using the caller's session, so an unprotected route is a request-forgery and route-enumeration surface. Enforce protection in code rather than convention: a config flag, middleware or gate authorization, an environment assertion, and preferably an IP allowlist. Register it only in local and developer environments, and never in shared staging or production.
- How does laravel-api-tester discover the routes it lists?
- It introspects Laravel's router route collection from inside the application, so every endpoint registered with the framework shows up automatically with no manual collection to maintain. Because it shares your exact route definitions, middleware stack, session, and auth context, requests behave like same-app requests. That also means it only sees the routes of the single Laravel app it is installed in, not services behind a gateway or other microservices.
- Can I send POST, PUT, PATCH, and DELETE requests with headers and auth?
- Yes. The UI supports all HTTP methods and lets you set headers and a request body, and it uses the caller's existing session and authentication context. JSON responses are displayed formatted in the browser for quick debugging. This makes it convenient for manually exercising endpoints, but it is a manual tool, not an automated test runner.
- Does laravel-api-tester work with Laravel 10 or Laravel 11?
- Not out of the box. The package has had no release since 2020, and its framework and PHP constraints predate Laravel 10 and 11, so composer require will typically fail and runtime deprecations are likely even after a constraint bump. Getting it running means forking and maintaining it yourself, including the Vue 2 front end and its pre-Vite asset pipeline. Budget for that fork ownership before piloting.
- What are the alternatives to asvae/laravel-api-tester?
- For generated API documentation try Scramble or Scribe; for automated contract checks use Pest or PHPUnit HTTP tests; for manual request building use Postman or Insomnia. The package's only real differentiator is zero-setup route discovery in a browser UI inside your app. If your team already standardises on Postman plus HTTP tests, the marginal value is small and declining the package is reasonable.
- Can I use laravel-api-tester for automated API testing in CI?
- No. It is a browser-based manual testing UI and provides no assertions, no test runner, and no CI integration. For regression coverage and contract checks, write Pest or PHPUnit HTTP tests against your routes instead. Use this package only for ad hoc browsing and debugging during development.
- How do I secure or disable the laravel-api-tester route?
- Gate the route in code with a config-driven enabled flag plus authorization middleware and an environment check, so it can only resolve on a developer machine. Restricting by IP allowlist adds a second layer, and keeping it a require-dev dependency prevents it shipping to production at all. Decide explicitly who owns that gate and how you will prove the route is unreachable outside local development.
- Is asvae/laravel-api-tester still maintained?
- Effectively no. There has been no release since September 2020 and there are no dependents on Packagist creating pressure to keep it working, so every new Laravel major becomes your patch obligation. The MIT license makes forking low-friction and low-risk legally, and because it is a dev-only dependency with no schema or data footprint, removing it later is trivial. Adopt it conditionally and time-boxed as disposable developer tooling, and set an exit trigger.