- How do I install goldnead/statamic-payments in a Laravel Statamic app?
- Install it with composer require goldnead/statamic-payments, then publish the addon config and migrations and run php artisan migrate. Add your Mollie or Stripe keys to the environment and configure the checkout routes in Statamic. Check the README for the exact publish tags and middleware requirements for your version.
- Does this Statamic payments addon support both Mollie and Stripe?
- Yes. The addon ships a MollieGateway and supports Stripe as a payment provider, with a hosted checkout flow so card data never touches your Laravel app. Provider selection is configuration-driven, so you can use Mollie or Stripe per checkout. Confirm the current driver matrix in the package docs before committing to a provider.
- How does the package handle webhooks securely?
- The webhook is designed to never trust the caller: it should verify the provider request and then fetch the authoritative payment state from the provider API rather than trusting the payload body. Fulfilment is tied to a persisted checkout_key with a unique database constraint, so duplicate webhook deliveries cannot fulfil the same order twice. Do not return 200 from proxies, WAFs or global exception handlers before the package has processed the event.
- What is checkout_key and why does it matter for idempotency?
- checkout_key is a nullable, unique column on the payments table that records which checkout a payment belongs to and makes fulfilment idempotent. The package also sends a provider-level Idempotency-Key and derives a dedupe key from basket, address, discount, return URL and payment methods within a 10-minute window. That protects against duplicate charges, but you should confirm the canonicaliser is stable and provide an escape hatch for legitimate repeat purchases.
- Why would the payment webhook return 503 and how should I handle it?
- A 503 is deliberate: it tells Mollie the webhook was not processed so the provider will redeliver, instead of silently accepting a paid-but-unfulfilled order. Make sure nothing between Mollie and Laravel normalises that response to 200, including reverse proxies, WAFs, API gateways, health-check middleware or a global exception handler. Monitor orders that outlive Mollie's retry window and alert on them.
- Can I implement a custom PaymentGateway without breaking idempotency?
- Custom PaymentGateway implementations must not forward the new idempotencyKey field verbatim into a third-party request body, because many APIs will reject the unknown field with a 400. Strict payload validators may also throw, so update your gateway contract and tests before upgrading. Treat v1.30.0 as a practical breaking change for custom gateways even though it is semver-minor.
- Which Laravel and Statamic versions does goldnead/statamic-payments support?
- The package is a Statamic addon for Laravel applications, so check its composer.json for the supported PHP, Laravel and Statamic constraints before installing. Version requirements can move with Statamic majors, and the payment path is tier-one infrastructure, so pin a tested combination in composer.lock. Run the addon's own test suite against your app's framework version in CI.
- How do I test payment flows and webhook retries locally?
- Use provider test keys and a tunnel such as ngrok or Expose to deliver webhooks to your local Laravel app. Simulate duplicate and out-of-order webhook deliveries and assert that the unique checkout_key prevents double fulfilment. Also test the 503 path through your real middleware and proxy stack, not just the controller in isolation.
- Is this package safe for production with high traffic and large payments tables?
- Adding a unique index to a large payments table can block writes on Postgres and take a metadata lock on MySQL, so plan the migration for a maintenance window or use a concurrent index strategy. In production, add backoff and jitter around provider calls and consider a circuit breaker so 429 responses do not amplify webhook retries. Monitor for retry-window exhaustion, because a long provider outage can still leave paid orders unfulfilled.
- How does this compare with Laravel Cashier or a custom Mollie integration?
- Laravel Cashier is a better fit for subscription billing, while this addon is aimed at one-off hosted checkouts tied to Statamic content and idempotent webhook fulfilment. A custom Mollie or Stripe integration gives you full control but you must rebuild signature verification, idempotency keys, retry handling and duplicate-safe fulfilment yourself. Compare the addon when you want those payment-path concerns handled inside Statamic rather than in bespoke controllers.