- How do I install and set up kielabokkie/laravel-conceal in a Laravel app?
- Install it with Composer using composer require kielabokkie/laravel-conceal, then check the package README for any optional config publish step. Adoption is opt-in: add the package's trait to the Eloquent model or models whose route keys you want to conceal. Once the trait is applied, route model binding should continue to work while generated URLs contain opaque strings instead of sequential IDs. Verify the package's composer.json constraints for PHP and illuminate/* before installing on your target stack.
- Does laravel-conceal still support Laravel route model binding?
- Yes, that is the intended design. The package exposes a trait that changes how a model's route key is generated and resolved, so standard route model binding keeps working with the concealed value. Your routes can still use implicit binding such as {user} and receive the correct model instance. Keep your authorization middleware and policies in place, because a concealed key changes the identifier format, not the access rules.
- Which PHP and Laravel versions does laravel-conceal support?
- Version 1.4.0 relaxes the Composer PHP constraint to allow installation on PHP 8 and updates the CI test matrix to PHP 8.x, but the release notes do not enumerate which PHP 8 minors are covered. PHP 8 support alone is not sufficient: confirm the illuminate/* constraints in the package's composer.json permit your target Laravel major before adopting. Test the install on the exact PHP minor you run in production rather than assuming broad PHP 8 compatibility.
- Does laravel-conceal use APP_KEY to encrypt route keys?
- The package conceals route keys by encrypting identifiers rather than exposing sequential database IDs, so generated URLs contain opaque strings. In a Laravel package this generally means the ciphertext depends on the application encryption key, so verify in the source or config whether it calls Laravel's Crypt facade with APP_KEY. If it does, URLs generated under one key will not resolve after a key rotation or on an instance configured with a different key. Treat key management and deployment consistency as part of the rollout plan.
- Is a concealed route key a replacement for Laravel authorization policies?
- No. Concealment is obfuscation, not authorization, and a concealed route key must never be treated as an access control. Developers who receive an opaque URL can still attempt requests, so you must keep authentication middleware, gates, policies, and ownership checks on model binding. Make this an explicit design-review item so teams do not skip policy checks because the ID looks unguessable.
- Can I conceal IDs on only some Eloquent models?
- Yes. The package is a low-coupling, single-purpose utility that is applied per model through a trait, so adoption is opt-in. Models without the trait keep exposing their normal route keys, and there are no schema changes or infrastructure dependencies to introduce. That makes it practical to start with one low-traffic model, verify behavior, and then expand to other models if needed.
- What breaks if I add laravel-conceal to an existing Laravel app with shared links?
- Changing how route keys are generated is a breaking change for any external consumer that stores or reuses URLs, including emails, webhooks, exported reports, and third-party callbacks. Links generated before adoption will not match the new concealed format, so plan redirects or a migration path for identifiers already persisted outside the app. Test link generation before and after adoption on a non-production environment and document the change for any integrators.
- How do I test routes and models that use laravel-conceal?
- Use Laravel feature tests that generate URLs with the route() helper and assert the correct model is resolved through route model binding. Add a test that a tampered or previously generated identifier returns a not-found response instead of resolving an unintended record. Continue using model factories as normal, and add a focused unit test for the model's route key if you customize any behavior around the trait.
- How does laravel-conceal behave across multiple app instances or an APP_KEY rotation?
- If the package encrypts route keys with the application key, every instance must share the same APP_KEY for generated URLs to resolve consistently. Rotating the key can invalidate previously generated concealed identifiers, so confirm the package's behavior in the source and test a rotation scenario before changing production keys. For multi-instance deployments, verify that all instances run the same package version and encryption configuration.
- What are alternatives to laravel-conceal for hiding model IDs in Laravel?
- Common alternatives include Hashids or Sqids-style encoding, UUID or ULID route keys, and overriding getRouteKey or resolveRouteBinding in your own model. Each approach has trade-offs in opacity, index performance, and migration effort, but none of them replaces authorization checks. If package maintenance becomes a concern, a small custom route-key implementation is a viable fallback because the surface area is limited to model binding.