- How do I install jansenfelipe/cpf-gratis in a Laravel application?
- Install it with composer require jansenfelipe/cpf-gratis and confirm the PHP version constraint matches your app before committing. Because the package is framework agnostic and does not ship Laravel auto-discovery, you wire it into your app yourself rather than relying on a generated config file. The surface area is small, so a spike usually takes hours rather than days. Run composer why-not on your HTTP client and DOM parser packages if the install resolves to unexpected versions.
- Does this package validate CPF numbers or actually look up CPF data on Receita Federal?
- Despite the marketing blurb about validation, the package's core purpose is consulting CPF data on the Receita Federal do Brasil website for free, returning registration details such as name, status and birth date. It is not an authoritative identity source and it is not primarily a checksum validator. If all you need is to reject malformed or mathematically invalid CPF numbers, a small local validator is lighter and far safer than a network call. Plan for it as a best-effort enrichment tool, not as a source of truth.
- Which Laravel and PHP versions does cpf-gratis support?
- Version support is defined only by the package's composer.json, so check the PHP constraint and any pinned HTTP client or DOM parser dependency before assuming compatibility with Laravel 10, 11 or 12. Laravel version compatibility mostly boils down to whether the underlying Guzzle or parser versions conflict with your existing dependencies. Because the package is framework agnostic, most conflicts are resolvable by pinning versions and testing in CI. Verify the last commit date and any open issues before adopting it in a long-lived project.
- Do I need to write a service provider or facade to use it with Laravel?
- Yes, expect to write your own binding because the package does not publish a Laravel service provider, facade or config file. The recommended approach is to define a CpfLookup interface and bind a scraping adapter that wraps this package inside a service provider, where you also configure timeouts, retries and a circuit breaker. Controllers and domain services should depend on the interface only, never on the package classes directly. That keeps the free option swappable and stops scraping logic from leaking into business code.
- Is cpf-gratis really free, or does it need a captcha service or proxies?
- Free here means no paid data provider subscription, not zero external cost. The package scrapes a government web page whose consultation flow has historically used captcha and anti-bot mechanisms, so confirm whether it depends on a captcha-solving service, a proxy pool or a legacy endpoint. Throughput is capped by what the target site tolerates, not by your infrastructure. Measure the real marginal cost per lookup and any third-party subscription before assuming the free tier is genuinely free.
- How reliable is the scraping, and what happens when the Receita Federal page changes?
- DOM scraping has no versioned contract, so any markup, layout or URL change can break parsing silently or loudly with no advance notice. There is a single maintainer and no published SLA, so treat breakage as expected rather than exceptional. Run roughly fifty calls in a sandbox against known CPFs to measure success rate, latency and failure signatures before trusting it. In production, wrap calls with timeouts, retries, a circuit breaker and a monitoring job that alerts when the success rate drops.
- Can I use cpf-gratis for KYC, onboarding or credit decisions in production?
- No, this is a best-effort enrichment utility and not an authoritative identity source, so a wrong or missing answer cannot be allowed to affect money or regulatory outcomes. It suits internal admin lookups, back-office validation and data cleanup where a failed lookup is an inconvenience rather than a compliance incident. For KYC, onboarding and credit decisioning, use a contracted bureau such as Serpro or BigDataCorp as the primary path. If you keep this package at all, treat it as a cost-reduction experiment behind a feature flag, never the reverse.
- Is it LGPD compliant to query and store CPF data with this package?
- CPF is personal data under LGPD, so processing it requires a documented legal basis, purpose limitation, retention rules and an audit trail regardless of how you obtain it. Scraping a government website may also conflict with that site's terms of use, which is a distinct legal question from data protection. Get legal and DPO sign-off before any production traffic, and decide up front whether you will store results at all. This is a policy decision that must happen before engineering work, not after.
- How do I test cpf-gratis without hitting the real Receita Federal site in CI?
- Never let your test suite call the live site, because tests would be slow, flaky and would contribute to rate limiting. Mock at your own CpfLookup interface instead, and add adapter-level tests that simulate timeouts, empty responses, malformed HTML and captcha challenges. A separate manual or scheduled smoke test against a known CPF is enough to detect when the upstream page changes. Keep that smoke test out of the blocking CI pipeline and alert on its failures.
- What are the alternatives to cpf-gratis for CPF lookups in Laravel?
- Contracted providers such as Serpro or BigDataCorp give you a supported API with a versioned contract, SLA and clearer LGPD positioning, at a per-lookup cost. For pure format and checksum validation there are lighter packages that never touch the network, which is often all a form actually needs. A common pattern is a paid provider as primary with this package behind a feature flag for non-critical paths. Evaluate alternatives against the true marginal cost of scraping failures and maintenance, not just the license price.