- How do I install laravel-api-debugger in a Laravel app?
- Install it as a development-only dependency with composer require --dev hesamrad/laravel-api-debugger, then publish the package config and attach its middleware to a dedicated debug route group. Because it hooks into Laravel's HTTP middleware pipeline, you should not need to change controllers or form requests. Confirm the exact config file name and middleware alias in the README, since those details can shift between releases.
- Which Laravel and PHP versions does laravel-api-debugger support?
- Laravel's middleware and HTTP kernel internals have changed across versions 10, 11, and 12, and small single-maintainer packages often pin narrowly or lag on new majors. Check the composer.json constraints and any CI matrix in the repository before committing to it for a specific major. If your app runs a Laravel or PHP version outside the declared range, test it in a scratch branch rather than assuming forward compatibility.
- Is laravel-api-debugger safe to use in production?
- Treat it as local and staging tooling only, because capturing request and response bodies is a data-handling decision rather than just a developer convenience. Attach the middleware only to a dedicated debug route group and keep it out of the global middleware stack in config/app.php. Hard-gate it by environment so a misconfigured deploy cannot silently start recording production payloads.
- Does it redact sensitive data like bearer tokens, passwords, and PII?
- Any tool that records JSON payloads will capture bearer tokens, passwords, PII, and internal IDs unless field-level redaction is built in and verifiable. Before adopting it, confirm whether the package ships header and key redaction, whether that applies to nested JSON, and whether it is enabled by default. If redaction is missing or incomplete, plan to add it or fork the package before using it outside local development.
- Where does captured data go: files, database, or cache? Can I control retention?
- The evaluation flags storage and retention as open questions, so confirm from the config which driver is used and whether retention is configurable. Decide up front whether captured payloads are acceptable in your app's storage layer, and add a retention limit or cleanup job if the package does not provide one. Avoid leaving unbounded capture enabled on a shared staging database.
- What performance overhead does the middleware add to API requests?
- Body capture implies buffering, so the real cost depends on payload size and whether the package caps captured content. Measure it yourself on a representative response, with around 100KB as a reasonable benchmark, and check whether oversized or streamed responses are truncated rather than fully buffered. Watch for memory growth, truncated logs, and broken file downloads when capture is enabled.
- Does laravel-api-debugger work with Laravel Octane, Swoole, or queued jobs?
- Long-lived workers behave differently from PHP-FPM, and per-request static state in middleware is a known bug class under Octane. The package is middleware-based, so it should work under Octane, but verify that captured data does not leak between requests in a resident worker. Queued jobs do not pass through HTTP middleware, so do not expect job payloads to be captured.
- How is this different from Laravel Telescope or Ray?
- Telescope and Ray are broad debugging and observability tools, while this package narrows in on JSON API request and response payloads. If your team already has Telescope or structured request logging backed by a mature observability stack, adding this creates a second debug channel and a second place sensitive data can leak. Adopt it only if you have a genuine gap specifically around inspecting API payloads.
- Does it register routes or a UI panel, and are they protected?
- This is a key question to answer before installing: whether the package only writes to logs and storage or also exposes a UI or inspection routes. If routes are registered, confirm they are both auth-gated and environment-gated and that they are not loaded in production. Review the service provider's route registration before enabling the package on any shared environment.
- Is laravel-api-debugger actively maintained, and what happens if it is abandoned?
- Adoption signals are weak, with roughly 20 stars and zero dependents, so you would be among the first production-adjacent consumers and should expect to find edge cases yourself. It is single-maintainer, so assume you may need to fork or vendor it, and check issue and PR turnaround before relying on it. Budget review and hardening effort, not just the afternoon it takes to install.