- How do I install jordisala1991/sermepa-omnipay with Composer in Laravel?
- Install it with Composer and register the gateway through Omnipay, then bind it as a singleton in a Laravel service provider and pull the merchant code, terminal, and secret key from config/services.php. The package is framework-agnostic, so Laravel integration is just a thin wrapper around Omnipay's purchase and completePurchase calls. Be aware that the last release was in March 2017, so Composer may refuse to install it alongside omnipay/common v3.
- Is this package compatible with Omnipay 3.x and current Laravel versions?
- It is very likely not compatible out of the box. The 2017 release predates the Omnipay 3 split into standalone gateway packages and the move to PSR-7 and PSR-18 transport, so its composer.json almost certainly targets omnipay/common v2. On a modern Laravel app you should expect dependency conflicts or an old Omnipay tree being dragged in, and you should confirm the declared constraints before scoping any work.
- How do I test Sermepa/Redsys payments without charging real cards?
- The gateway supports configurable test and production endpoints, so point it at the Redsys test environment (sis-t.redsys.es) and use the test merchant credentials your bank provides. Exercise a full purchase and notification cycle there, and specifically verify that the request signature is accepted, because a broken 3DES-derived key often fails only in production. There is no test suite or CI in the repository, so any automated coverage has to be written by you.
- Does this driver implement the HMAC_SHA256_V1 signature with 3DES key derivation?
- The package advertises SHA-256 merchant signature generation, and a 2017 release probably handles Redsys' HMAC_SHA256_V1 scheme, which derives a per-order key by applying 3DES to Ds_Merchant_Order using the merchant key. However, that derivation must be proven against the live Redsys test environment rather than assumed. A silent fallback to SHA-1 or an incorrect 3DES step will fail in production, not in staging.
- Does the package verify the Redsys notification signature?
- The overview claims response validation for secure notification handling, but with no tests, CI, or issue history there is no evidence of how thorough that check is. The callback endpoint is an unauthenticated public POST, so you must independently verify the signature, reconcile the amount and order number, and enforce idempotency before marking an order paid. Treat any inherited verification code as unverified until you have written tests against it.
- How should I handle the Redsys callback or notification in a Laravel controller?
- Expose a POST route that accepts Redsys' form-encoded notification, parse it through Omnipay's completePurchase or notification response, and verify the signature before trusting any field. Then reconcile Ds_Amount and Ds_Order against your own records, handle replays idempotently, and return the HTTP 200 response Redsys expects. Because this package is unmaintained, keep the controller thin but the validation logic explicit and covered by tests.
- Does this Omnipay gateway support 3D Secure v2 and PSD2 SCA?
- Almost certainly not. PSD2 strong customer authentication became mandatory in the EU in 2019, two years after this package's last release, and a 2017 gateway is unlikely to include Ds_Merchant_EMV3DS payloads or exemption flags. A pure non-3DS redirect will increasingly be declined by Spanish issuers. If you fork the package, adding 3DS2 support is the main piece of work you will need to budget for.
- Can I process refunds or pre-authorizations with this package?
- The overview mentions refund support alongside purchase and callback handling, so basic refunds may be represented. Pre-authorization and partial capture are typically out of scope for this style of Redsys hosted gateway and are usually handled through a separate bank-side interface. Also watch Redsys' order-number constraint of 12 characters, commonly a 4-digit numeric prefix plus 8 alphanumeric characters, which is a classic source of production bugs.
- Is jordisala1991/sermepa-omnipay maintained and safe for production?
- There are no signs of maintenance: zero stars, zero dependents, a last release in March 2017, no CI, no tests, and no issue history. It is a single-author repository that has been effectively abandoned, and it sits directly on a security-sensitive code path involving signatures and payment notifications. The realistic evaluation is whether it is a usable reference implementation to fork, not whether you should composer require it.
- What are the maintained alternatives for Redsys payments in Laravel?
- Look for a current Omnipay Redsys gateway that supports Omnipay 3.x and PSR-18, or integrate Redsys' official REST/JSON API using a supported SDK. Another option is to fork this package, upgrade its Omnipay dependencies, add 3DS2 and SCA handling, and write your own signature and notification tests. Given the abandonment risk, comparing against the official Redsys API is usually the safer starting point.