Weave Code
Laravel Spy Laravel Package
farayaz/laravel-spy
Laravel Spy is a lightweight, zero-config package that automatically tracks and logs outgoing HTTP requests from Laravel's HTTP client and Guzzle, capturing URL, method, headers, payload, response, status, and duration with configurable sensitive-data obfuscation for debugging and auditing.
Laravel Spy is a lightweight, zero-config package that tracks and logs every outgoing HTTP request your Laravel application makes. Whether requests go through the Http facade or directly via Guzzle, Spy captures the full request lifecycle so you can debug, monitor, and audit external API traffic without modifying your application code.
- Captures URL, method, headers, payload, and response for each request
- Tracks traffic from both Laravel's HTTP client and Guzzle
- Records response status codes and request duration in milliseconds
- Provides configurable logging with optional obfuscation of sensitive data
Frequently asked questions about Laravel Spy
- What is farayaz/laravel-spy used for?
- Laravel Spy is a lightweight package that automatically tracks outgoing HTTP requests made through Laravel's HTTP client and Guzzle. It logs URLs, methods, headers, request payloads, response headers and bodies, status codes, and request duration into an http_logs table. Developers use it for debugging vendor API failures, auditing external calls, and turning support incidents into queryable records.
- How do I install and set up Laravel Spy?
- Install it with composer require farayaz/laravel-spy, publish the package config and migration with Laravel's vendor:publish command, and run php artisan migrate. The service provider is auto-discovered, so no manual registration is needed. After that, outgoing requests through Laravel's Http facade and Guzzle are captured according to the published configuration.
- Which Laravel and PHP versions does Laravel Spy support?
- Laravel Spy requires PHP 8.1 or newer and supports Laravel 10, 11, 12, and 13 according to the package README. Development dependencies include Pint and PHPUnit versions for linting and tests, but they are optional for application use. Check the package constraints before upgrading a Laravel major version, especially if upstream maintenance slows.
- Does Laravel Spy capture Guzzle requests outside Laravel's HTTP client?
- Yes, Guzzle capture is enabled by default according to the README, but Guzzle clients outside Laravel's container require the documented manual mode. Requests made with raw cURL or clients that do not pass through the instrumented Guzzle setup can silently escape capture. Confirm early that the outbound traffic you care about actually transits the Http facade or a wrapped Guzzle client.
- How do I configure or disable Laravel Spy in different environments?
- Configuration is published as a package config file and includes environment-level toggles such as SPY_ENABLED and SPY_DASHBOARD_ENABLED. You can disable capture entirely with SPY_ENABLED=false, which makes adoption reversible without code changes. Use environment-specific settings to turn tracking off or limit it in high-volume or non-production contexts.
- How does Laravel Spy handle sensitive data like headers and request bodies?
- Laravel Spy can log headers, request bodies, response headers, and response bodies by default, so sensitive values such as bearer tokens, PII, and payment payloads must be handled deliberately. The package provides configurable logging options to customize and obfuscate sensitive data, but the obfuscation ruleset should be owned and tested as a reviewed artifact. Treat the http_logs table as a secondary copy of sensitive data and apply the same access, retention, and deletion controls as production data.
- Can Laravel Spy be used in production, and what are the risks?
- Production use is possible, but the dominant risk is data exposure rather than code quality because raw request and response data can expand PCI or GDPR scope. Secondary risks include synchronous writes on the request path for high-volume services and unbounded table growth if cleanup is never scheduled. Define which URLs to exclude, which fields to obfuscate, and how long to retain rows before enabling it broadly.
- How do I test Laravel Spy or verify outgoing requests are logged?
- To verify capture, make a request through Laravel's Http facade in a test or local environment and confirm a row is written to http_logs with the URL, method, headers, payload, response, status, and duration. The package includes PHPUnit as an optional development dependency, so you can assert logging behavior in your own test suite. Also test the disabled state with SPY_ENABLED=false to confirm your application still behaves normally.
- How should I secure the Laravel Spy dashboard?
- The dashboard is controlled by SPY_DASHBOARD_ENABLED, so you can disable it entirely or expose it only behind authentication in non-production environments. Do not leave an unauthenticated dashboard reachable in production because it can reveal request headers, payloads, and responses. Treat dashboard access as part of the same data classification and access-control review as the http_logs table.
- How does Laravel Spy compare to APM tools, and what if the package is abandoned?
- Laravel Spy is a forensic log, not a telemetry pipeline, so it complements rather than replaces APM tools, traces, spans, or structured logging. For alternatives, consider your existing observability vendor if the gap is general outbound visibility; choose Laravel Spy when you specifically need queryable request and response pairs inside Laravel. Maintenance risk is real: the package has a single maintainer and small footprint, so pin the version, monitor releases, and be prepared to fork and vendor the roughly 500-LOC package if upstream stalls.
Weaver
How can I help you explore Laravel packages today?