- How do I install lisennk/laravel-slack-events-api in a Laravel app?
- Install it with Composer using composer require lisennk/laravel-slack-events-api, then publish the package configuration and register the service provider if your Laravel version does not auto-discover it. Set your Slack signing secret in the environment file and point your Slack app's Request URL at the route the package exposes. On a supported Laravel 5 through 8 stack this is typically well under a day of setup, but on Laravel 9 or newer you should expect to widen constraints or fork first.
- Which Laravel versions does this package support?
- The package advertises support for Laravel 5, 6, 7, and 8, and its last release was in April 2021, which predates Laravel 9. On Laravel 9 and newer it is a fork-and-patch exercise rather than a plain composer require. Note that Laravel 5, 6, and 7 are end-of-life, so if you are on those versions the framework itself is the bigger risk than this package.
- Does it verify Slack request signatures and protect against replay attacks?
- Signature verification is a core part of the package's job: it validates incoming Slack callbacks against your signing secret before dispatching events. Because this is a security-critical surface, read the middleware line by line during your spike and confirm it uses hash_equals for constant-time comparison and rejects timestamps older than roughly five minutes to block replays. Do not assume those protections exist just because the package verifies signatures.
- How does it handle Slack's url_verification challenge?
- The package performs Slack's url_verification handshake and returns the challenge value so Slack can confirm your endpoint during app setup. Confirm in testing that it returns the raw challenge without extra serialization or wrapping, since Slack expects the exact token back. If the route sits behind proxies or middleware that rewrites responses, test the handshake end to end.
- How are Slack events routed to my Laravel listeners?
- Incoming Slack events are re-broadcast as native Laravel events, so you react with standard Event and Listener classes instead of writing a custom controller. Map Slack event names to your own domain events in an adapter layer so Slack payload shapes do not leak into business logic. Also check which Slack event types and subtypes the package maps and what happens to unmapped ones, because a silent drop versus an error matters in production.
- Will this package work on Laravel 9, 10, or 11?
- Not as-is. The package advertises Laravel 5 through 8 and last shipped in April 2021, which predates Laravel 9, so composer require will fail on modern versions unless you widen the constraint in a fork. The transport logic is small, roughly a route, middleware, and an event dispatcher, so vendoring or reimplementing it in-house is a credible path on Laravel 9 and newer. Also verify it runs cleanly on PHP 8.1 and above without deprecations.
- Is lisennk/laravel-slack-events-api still maintained and safe for production?
- Maintenance risk is high: there has been no release in roughly four years, there is a single maintainer, and the package has effectively no dependent ecosystem. The MIT license makes forking viable, but you are adopting ownership on day one. On newer Laravel versions, treat it as reference source rather than a dependency you can rely on for security fixes.
- What happens with Slack retries and the three-second response requirement?
- Slack requires a 2xx response within three seconds and retries failures with backoff, exposing X-Slack-Retry-Num on retried deliveries. The package appears to dispatch events in-request, so if listeners run synchronously you risk retry storms and duplicate event processing. Acknowledge Slack quickly, push real work onto Laravel queues, and use the retry header plus your own idempotency keys to de-duplicate.
- What are the alternatives if this package is abandoned?
- Slack Bolt for PHP is the maintained first-party option and a natural replacement if you outgrow this package. Because this package is a thin adapter, you can also reimplement the route, signature middleware, and event dispatch in-house with full test coverage. Keep the Slack Request URL stable and put an internal mapping layer in front so swapping implementations only changes the adapter.
- Does it handle Slack OAuth installation and bot tokens, or only inbound webhooks?
- This package is scoped to receiving inbound Slack Events API callbacks, not the OAuth installation flow, so you source and store bot tokens elsewhere. You still need a Slack app configured with the right scopes and event subscriptions pointing at your endpoint. If you need multi-workspace installation, plan that as separate infrastructure.