- Is lemonway/php-sdk a Composer package I can install in a Laravel app?
- Treat it as a reference implementation rather than a normal dependency. The repository is a DirectKit XML client example built with simple HTTP requests, and the evaluation notes no PSR-4 autoloading, no versioned release history, and no framework wiring. In Laravel you would copy or fork the relevant code into an infrastructure adapter instead of expecting composer require to give you a maintained SDK.
- Does this Lemonway PHP SDK support Laravel 8, 9, 10, or 11?
- There is no Laravel service provider, facade, or package discovery, so it does not formally support any Laravel version. The underlying PHP code can run on Laravel 8+ with PHP 8.x if you port it into app code. Laravel compatibility is therefore your responsibility, not a package guarantee.
- How should I configure Lemonway sandbox and production credentials in Laravel?
- Keep credentials in config/services.php backed by environment variables, never in source or committed sample files. DirectKit calls use parameters such as wlLogin, wlPass, walletIp, language, and version, and sandbox versus production endpoints differ by account path. Confirm IP whitelisting with Lemonway before testing, because authentication failures are often network or whitelist issues rather than XML problems.
- What operations does the Lemonway PHP SDK cover?
- The sample demonstrates wallet creation and management, beneficiary accounts, payments, SEPA transfers, payouts, KYC document upload, and transaction status calls. It also shows the XML request and response envelopes for operations such as MoneyInWebInit, MoneyIn, card registration, refunds, and GetWalletDetails. Coverage is by example, so verify each operation against current Lemonway documentation before relying on it.
- Can I use this package for marketplace wallets, escrow, and payouts?
- It can help you learn the Lemonway wallet and payout call shapes for a marketplace model where funds are collected, held, and paid out. However, the sample is not a domain model: wallet and wlRef concepts should stay inside a PaymentGateway adapter and out of your Laravel domain layer. Budget discovery time for Lemonway compliance onboarding and reconciliation rules, not just HTTP plumbing.
- Does this SDK handle Lemonway webhooks and payment status callbacks?
- The overview mentions webhooks and status callbacks, but the sample is primarily a DirectKit XML request client, so do not assume a complete webhook subsystem. You will likely need to implement callback routing, source validation, idempotent status handling, and reconciliation in Laravel yourself. Treat any callback handling in the sample as a starting point that needs hardening before production.
- Is Lemonway DirectKit XML deprecated in favour of DirectKit JSON and OAuth2?
- The technical evaluation flags DirectKit XML as the older surface, while Lemonway steers integrators toward DirectKit JSON with OAuth2. The deprecation timeline is a gating question: confirm with Lemonway whether the XML endpoints are still supported and for how long. If JSON/OAuth2 is the long-term path, a mid-project rewrite is the expensive failure case.
- What PCI DSS and PSD2/SCA issues come with card registration and MoneyIn?
- Card registration and money-in can pull PCI DSS, PSD2/SCA, and 3-D Secure into scope, especially if the sample posts raw card data to your server. Hosted fields or iframe card entry can keep you out of scope where direct PAN handling would not. Confirm whether the example demonstrates hosted card entry or raw card data before estimating compliance cost.
- Is this Lemonway client production-ready? Does it have tests, retries, or idempotency?
- No. The evaluation notes string-concatenated XML, no timeouts, no retry policy, no idempotency, no structured error mapping, and credentials in plain config. It also has no tests, no CI signal, and very low adoption, so nobody has publicly validated it in production. Before real money moves, replace the transport, add timeout and retry controls, map errors, and secure secrets.
- What is a safer Lemonway integration approach for Laravel?
- Spike the sandbox with a read-only call such as GetWalletDetails or GetWalletStatus to validate credentials, IP whitelisting, and XML parsing first. Put the client behind a PaymentGateway port in app/Infrastructure/Payments/Lemonway, and promote it to a private Composer package if multiple services need it. Avoid opening with irreversible MoneyIn or SendPayment calls, and ask Lemonway about a maintained private client or the JSON/OAuth2 path before forking the public sample.