- What is hotmeteor/receiver used for in Laravel?
- Receiver is a Laravel package for accepting and handling incoming webhooks. It resolves an inbound request to a named provider, verifies the provider signature, normalizes the event, and dispatches a handler class or job. It is intended for integrations such as Stripe, GitHub, Postmark, and similar services.
- How do I install hotmeteor/receiver in a Laravel application?
- Install it with Composer as hotmeteor/receiver; the package supports Laravel auto-discovery. Configuration lives in config/services.php, so you add provider credentials and endpoint settings there. After installation, define endpoints and handler classes for the providers you enable.
- Which webhook providers does Receiver support out of the box?
- The package lists first-party support for providers including Stripe, GitHub, Postmark, Shopify, Twilio, Mailchimp, SendGrid with ECDSA, and Paddle with key rotation. Coverage has expanded in v1.0.0, and the receiver:make --provider scaffold lets you add in-house or niche vendors. Check the README for the current provider list and per-provider configuration.
- How do I configure Receiver for a provider like Stripe or Postmark?
- Configuration lives in config/services.php, and the README includes per-provider config examples. For Postmark, the ips, headers, and auth strategies are combinable, which helps answer security review questions about request authenticity. You will also define the endpoint and handler mapping for each provider you enable.
- Which Laravel versions does Receiver support?
- The supplied context does not list exact Laravel version constraints, so check the package composer.json and README before installing. It is built for Laravel applications and uses standard Laravel features such as auto-discovery and config/services.php. Confirm compatibility with your application's Laravel and PHP versions as part of the proof of concept.
- How does Receiver verify webhook signatures, and what can break verification?
- Receiver verifies provider signatures as part of resolving an inbound request to a named provider. Verification depends on the raw request body, so Laravel middleware that mutates or re-encodes the payload can silently break HMAC verification. Provider strategies such as IP checks, header checks, and auth can be combined for providers like Postmark. Make sure invalid signatures return non-2xx responses so senders retry.
- How do I handle multiple events in a single webhook request?
- In v1.0.0, getEvent() returns an array of event_name and eventData pairs, and Receiver dispatches one handler per event. This supports batch payloads, which are common for providers such as SendGrid. Audit any custom providers and handlers that assumed a single event or returned a bare event before upgrading.
- How do I create a custom provider or handler with Receiver?
- Use the receiver:make --provider scaffold; it emits a companion ServiceProvider for auto-discovery. Event strings map to handler classes by convention, for example PAYMENT.AUTHORIZATION.CREATED maps to PaymentAuthorizationCreated. Be aware that distinct provider events can normalize to the same class name, so review naming collisions.
- How can I test Receiver webhook endpoints in Laravel?
- The context does not describe dedicated testing helpers, so use Laravel HTTP tests with a raw payload and the provider's expected signature headers. Assert that the correct handler or job is dispatched for valid requests. Also test invalid signatures and malformed payloads to confirm the endpoint returns non-2xx where appropriate.
- What production risks should I consider before using Receiver, and when should I look at alternatives?
- The main risk is supply chain: a single-maintainer package sits directly in the unauthenticated attack surface of your application. Pin the version, review the verification code paths for each provider you enable, and ensure failures return non-2xx. Receiver replaces bespoke webhook verification middleware, but alternatives include provider SDK webhook helpers or custom middleware if you need different coverage or maintenance guarantees.