- How do I install lanin/laravel-api-debugger?
- Install it with composer require lanin/laravel-api-debugger. The package follows the standard Laravel package shape: an auto-discovered service provider, a publishable config file, and HTTP middleware you register on the routes you want to inspect. Check the PHP and laravel/framework constraints in its composer.json before committing, since the package has very little visible adoption and may be pinned to an older Laravel major.
- Does laravel-api-debugger support Laravel 10 and Laravel 11?
- The available metadata does not state explicit Laravel or PHP version constraints, so read the require block in the package composer.json before installing. Packages in this low-adoption band are often pinned to older Laravel majors and may not install cleanly on Laravel 10 or 11 without a fork. Test the install on a throwaway branch against your target framework version first.
- How does laravel-api-debugger actually work?
- It registers HTTP middleware that augments JSON responses with a debug payload containing queries, timings, memory usage, and request context. You do not need to change controllers or API resource classes, which keeps the integration small. The trade-off is that diagnostics travel inside the response body rather than through a separate channel such as a dashboard, log, or storage backend.
- Is it safe to use laravel-api-debugger in production?
- No. Treat it strictly as a development tool and gate it behind an explicit, tested environment check. The debug payload can include SQL, query bindings that may contain PII, and internal file paths, so a single environment-detection mistake turns it into a data disclosure vector. Do not rely on the package to enforce that guard for you.
- What is the difference between laravel-api-debugger and Laravel Telescope?
- Telescope is first-party, actively maintained, records diagnostics out of band, and never mutates your API responses. laravel-api-debugger embeds debug data directly in the JSON payload, which is convenient while iterating but couples diagnostics to your API contract. For most teams, Telescope plus a local profiling workflow covers the same need with less risk.
- How do I enable laravel-api-debugger only for specific routes or environments?
- Register the middleware on specific route groups, such as an internal or local-only API prefix, rather than globally in the HTTP kernel. Pair that with an explicit environment check so the middleware short-circuits outside local development. Because delivery is middleware-based, you can keep the blast radius small by scoping it deliberately.
- Does laravel-api-debugger expose SQL query bindings or sensitive data?
- The assessment flags that debug payloads of this kind typically include SQL statements, query bindings, and internal paths, and that bindings can contain personal data. The available material does not confirm a built-in redaction mechanism, so assume you need to add or verify one yourself. Avoid pointing it at endpoints that handle personal, payment, or credential data without a security review.
- Will laravel-api-debugger break my API tests or JSON schema validation?
- Potentially yes. Any consumer that generates types from responses, runs snapshot tests, or validates a strict JSON schema will break once the extra debug key appears. Keep the middleware disabled in your test environment, or assert on a subset of the payload rather than exact equality.
- Is laravel-api-debugger still maintained, and what are the alternatives?
- There is no adoption signal: zero stars, zero dependents, and a composite score of zero in the assessment. That typically correlates with no active maintenance, no security triage, and no compatibility updates, so treat it as source-available rather than a supported dependency. Confirm commit recency, CI, and license before relying on it, and consider Telescope, Debugbar, or Clockwork as maintained alternatives.
- How does laravel-api-debugger behave on exception responses and non-JSON responses?
- The package is described as debugging JSON API responses, so its behavior on exception responses and non-JSON output is not documented in the available material. Middleware that decorates responses can interfere with the exception handler if it runs on error paths, so test 404s, validation errors, and 500s explicitly. If it misbehaves, restrict it to successful responses or to a route group that excludes error handling.