Product Decisions This Supports
- Real-time roadmap scoping. This package is the Laravel-side integration for Centrifugo (self-hosted websocket/pub-sub server): broadcast driver, JWT channel-auth token generation, and install scaffolding. It directly enables features like in-app notifications, chat/messaging, presence and typing indicators, live ops/order dashboards, auctions and bidding, and collaborative editing.
- Build vs. buy for realtime infrastructure. The core PM decision is Centrifugo + this package (self-hosted, predictable infra cost) vs. managed Pusher/Ably/Supabase Realtime (per-connection/per-message pricing, zero ops) vs. Laravel Reverb (first-party, simpler, single-stack). Cost-curve modeling at projected concurrent connections and message volume is the deciding input, not feature parity.
- Security and tenancy sign-off. The v5.3 fix making broadcaster auth tokens use the authenticated Laravel user id is a correctness fix in the channel-authorization path. For multi-tenant or private-channel products this is the difference between "auth model we can put through security review" and "auth model we must wrap ourselves." It supports a decision to rely on the package's auth rather than building a custom token layer.
- Reliability and degradation strategy. Normalizing Centrifugo transport failures into
BroadcastException makes failure handling uniform with the rest of Laravel's broadcasting stack — enabling queued retries, fallback to polling, alerting, and error-budget tracking without custom adapter code. That's a prerequisite for committing to a realtime SLO.
- Framework upgrade planning. Laravel 13 support (plus install-path coverage for Laravel 9–13) keeps the package on the upgrade train, so realtime doesn't become the blocker on a platform upgrade. Treat "supports the Laravel version we'll be on in 12 months" as an adoption gate.
- Integration-cost / time-to-POC estimate. Real Docker-based Centrifugo integration checks, fresh-install E2E for Laravel apps, and a genuine websocket private-subscribe E2E with
centrifuge-js materially lower the cost of a spike. It converts "we think private channels work" into "there's a test proving the full browser→Laravel auth→Centrifugo→private channel path," which shortens a feasibility spike from weeks to days and reduces the engineering buffer in the estimate.
- Extensibility/testability decisions. The
CentrifugoInterface container-binding fix makes the transport swappable and mockable, supporting a decision to abstract realtime behind an internal interface so a later vendor change (Centrifugo → Reverb → managed) is a bounded swap rather than a rewrite.
When to Consider This Package
Adopt when:
- Centrifugo is the chosen (or shortlisted) realtime server and Laravel is the backend — this is the maintained bridge, not a generic websocket library.
- You need private/presence channels authorized against Laravel's existing auth/user model, and
centrifuge-js on the client.
- Scale or cost argues against per-connection SaaS, and you have the ops capacity to run Centrifugo (Docker/K8s, Redis or similar for broker presence, monitoring).
- You're on Laravel 9–13; Laravel 13 specifically is now supported, and the installer handles the modern app skeleton.
- You want a DI-bound transport contract so realtime is testable in CI and replaceable later.
Look elsewhere when:
- You want zero-ops managed realtime with a vendor SLA — Pusher, Ably, Supabase Realtime. The ops burden is real and lands on platform/SRE, not the feature team.
- You're standardized on Laravel Reverb / first-party Echo and have no reason to add Centrifugo; two realtime stacks is pure overhead.
- The product needs capabilities outside Centrifugo's model (complex server-side message history/compliance retention, global edge delivery guarantees, managed moderation tooling) — those become custom builds.
- Your team has no container/orchestration experience, or realtime is a nice-to-have where a SaaS line item is cheaper than engineering time.
- You need a commercial support contract; verify maintainer capacity and release cadence before betting a customer-facing feature on it. The v5.3 test-infrastructure investment is a positive signal here, but it isn't a support agreement.
- You're not on Laravel — the package is Laravel-specific by design.
How to Pitch It (Stakeholders)
For executives: v5.3 is a maturity release for our Laravel↔Centrifugo realtime integration. It adds Laravel 13 support and closes three gaps that mattered for us: channel authorization now scopes tokens to the authenticated user (security-relevant for private and multi-tenant channels), transport failures surface as standard Laravel broadcast exceptions (so we get retries, fallbacks, and alerting for free), and the transport binding is fixed so realtime is mockable in tests. Alongside that, the maintainer added real Docker-based Centrifugo integration tests, fresh-install end-to-end coverage, and a true browser-level private-channel websocket test. Net effect: lower integration risk, faster path from spike to shipped feature, and a credible option to self-host realtime instead of paying per-connection SaaS pricing as we scale.
For engineering: this is the piece that makes Centrifugo a drop-in Laravel broadcast driver with sane auth, a swappable CentrifugoInterface, and exceptions that behave like the rest of the broadcasting stack. The new E2E coverage means we're not the first to exercise private-channel subscribe. Caveat: running Centrifugo is our operational responsibility — plan for deployment, Redis/broker, TLS, and monitoring before committing to a launch date.
Recommendation: timeboxed spike (1–2 weeks) against our real connection/message forecast, with two explicit decision gates — SRE confirms the ops model, and security signs off on the channel-auth/token model. If both clear, adopt; if either fails, the interface abstraction keeps a Reverb or managed-SaaS swap contained.