- What is laravel-admob-ssv used for?
- It is a single-purpose Laravel package that performs Google AdMob server-side verification (SSV) for rewarded ad callbacks. It validates the ECDSA signature on the callback query string against Google's published verification keys and checks the callback parameters so your app can trust that an ad view actually happened before granting a reward. It does not serve ads, call AdMob reporting APIs, reconcile revenue, or verify callbacks from other mediation networks.
- How do I install casperlaitw/laravel-admob-ssv in a Laravel app?
- Install it with composer require casperlaitw/laravel-admob-ssv, then publish the package config if you need to change defaults. Register or confirm the SSV callback route, point your AdMob SSV callback URL at it, and implement a listener that grants the reward. Follow the README for the exact publish tag and route setup, since those details are the parts most likely to change between releases.
- Which Laravel versions does laravel-admob-ssv support?
- Version 1.5.0 is the release that added Laravel 12 and Laravel 13 constraint support, on the PHP 8.x line. Because that release is compatibility-only, confirm whether the project's CI matrix actually runs the test suite on Laravel 12 and 13 rather than merely permitting them in composer.json. Historically the package's releases track Laravel major releases, so support for a brand-new Laravel major may lag your upgrade cadence.
- How does the package verify an AdMob SSV signature?
- It verifies the ECDSA signature carried in the callback query string using Google's published verification key set, selecting the key by key_id. Signature verification is the security boundary here, so a subtle mistake in algorithm choice, key selection, or query-string URL encoding before verification can silently fail open or fail closed. Treat any change to this code path between versions as security-relevant and review the diff rather than relying on the changelog.
- How do I register the AdMob SSV callback route in Laravel?
- The package provides an HTTP endpoint that Google calls, wired in as middleware plus a route, and that route must be publicly reachable over HTTPS. Check whether the route is registered automatically by the package or is opt-in, because an auto-registered route can conflict with a path you already use. Then paste that full URL into the SSV callback URL field in your AdMob console.
- How do I award a user reward after the callback is verified?
- The package surfaces a verified event to your application, so business logic belongs in a listener rather than in the verification layer. In that listener, grant in-app currency or unlock an entitlement using the verified transaction_id and your own custom parameters such as user_id. Queue the listener if reward granting hits the database or an external service, and validate any custom identifiers server-side.
- How do I handle duplicate AdMob SSV callbacks and transaction_id idempotency?
- Google can retry callbacks, and de-duplication is the host application's responsibility rather than something the package can know about. Store transaction_id under a unique constraint and make reward granting idempotent so a retried callback cannot double-credit a user. This matters most in production reward flows, where a duplicate grant is a direct financial loss.
- What happens if Google's verification key endpoint is unavailable?
- Verification depends on fetching Google's key set, so the cache TTL and the behavior when that endpoint is unreachable must be an explicit decision in your config rather than an assumed default. The safe behavior is to fail closed or serve a still-valid cached key set, never to skip verification. Confirm the package's actual behavior in code, including whether the TTL is configurable, before you rely on it in production.
- Can I disable AdMob SSV verification in staging or for local testing?
- You should not make signature verification optional or bypassable in any environment, including staging, because the endpoint is publicly reachable and a bypass becomes a way to forge reward grants. For automated tests, mock the key source or generate a test key pair instead of turning verification off. For manual testing, replay a captured real callback or drive the flow through AdMob's test ads.
- Is laravel-admob-ssv safe to depend on in production, and what are the alternatives?
- It is a narrow, low-blast-radius package, but it is small and effectively single-maintainer open source, so weigh bus factor and Laravel-major version lag against your upgrade cadence. Version 1.5.0 was a compatibility-only release with outside contributors and no stated functional or security changes, which is low risk to existing behavior but says nothing about depth of testing. If that risk is unacceptable, the alternative is implementing verification yourself with Google's published keys and openssl_verify, which is more work but removes the third-party dependency on a security-critical endpoint.