- Is hoya/masterpass-bundle compatible with Laravel?
- No, not natively. Despite being listed among Laravel packages, hoya/masterpass-bundle is a Symfony2 bundle built around a Bundle class, a DependencyInjection extension, and service YAML. Laravel has no bundle loader, so that container wiring never executes in a Laravel host. Only the plain PHP pieces, such as the OAuth signer, HTTP clients, and DTOs, are portable, and they must be re-wrapped in a Laravel ServiceProvider.
- How do I install hoya/masterpass-bundle with Composer?
- You would run composer require hoya/masterpass-bundle, but expect resolution problems. The package was last released on 2018-07-02 and typically pins PHP 7.x with Symfony 2.8 or 3.x components, which usually conflict with the transitive Symfony dependencies of a modern Laravel application. In most cases the realistic path is to fork the repository into an internal namespace rather than require it directly.
- Does hoya/masterpass-bundle still work now that Mastercard retired Masterpass?
- That is the biggest unknown and the top technical risk. Mastercard retired the Masterpass brand in favour of Click to Pay and MPGS, so a bundle last released in 2018 is likely pointed at deprecated or offline endpoints and credential flows. Confirm with your acquirer or PSP whether Masterpass or Click to Pay is still contractually available to you in your target markets before writing any code.
- How do I configure merchant credentials and the sandbox or production environment in hoya/masterpass-bundle?
- Configuration is handled through the bundle's DI extension, meaning service YAML and bundle-level config keys rather than a Laravel config file. There is no config publishing, facade, or config/masterpass.php out of the box. If you fork and re-wrap the package, you would expose those merchant credentials and the sandbox/production switch through a publishable Laravel config file.
- How does the Masterpass redirect and callback checkout flow work in this bundle?
- The merchant flow is a redirect-based wallet handshake: request a token, redirect the shopper to the Masterpass wallet, receive a callback with a verifier, exchange it for an access token, then fetch the checkout resource. A complete implementation also performs the postback confirmation leg. Check the source to confirm the postback step is implemented rather than only the front-half retrieval.
- Which PHP and Symfony versions does hoya/masterpass-bundle require?
- Based on the 2018 release date, expect PHP 7.x and Symfony 2.8 or 3.x components, plus an older Guzzle version and an OAuth subscriber library. Read composer.json in the repository to confirm the exact constraints, since abandoned transitive dependencies such as old Guzzle OAuth plugins are the likely casualties of any upgrade. Any Laravel integration will need those pins replaced with maintained equivalents.
- Is hoya/masterpass-bundle maintained, and does it have tests or a security policy?
- There is little sign of maintenance. The repository shows zero stars, zero dependents, a single author, no releases since July 2018, and no test suite, issue history, or security response path to evaluate. That means you cannot assess code quality before committing, and any fork becomes yours to own and audit.
- How do I use hoya/masterpass-bundle in a Laravel app if I still need Masterpass?
- Treat it as a reference implementation to mine, not a package to install. Fork into an internal namespace, isolate the protocol-bearing classes such as the OAuth 1.0a signer, token and checkout clients, and DTOs, then delete the Bundle class, DI extension, and service YAML. Re-wrap the survivors in a Laravel ServiceProvider with a publishable config file, pin dependencies to current versions, and budget days of engineering with a named owner.
- Does hoya/masterpass-bundle keep cardholder data off my server and limit PCI scope?
- It depends on the implementation, and you must verify it in the source before shipping. A pure redirect plus token handoff keeps cardholder data out of your infrastructure and keeps PCI scope small. If cardholder data is ever posted to your server, scope expands significantly, which is a serious concern for untested, unaudited code on the checkout path.
- What are the alternatives to hoya/masterpass-bundle for wallet and Masterpass payments?
- Look first at official Mastercard SDKs or Click to Pay documentation, and at PSP-hosted wallet options such as Adyen, Stripe, or Braintree that handle the token handshake for you. A maintained PSP integration removes the abandoned-dependency and security-response problems entirely. Only fall back to a fork of this bundle if your acquirer confirms Masterpass is still live for you and no supported SDK exists.