- What does marjose123/filament-webhook-server actually do?
- It adds a Filament panel page plus a plugin bootstrapper that lets admins create and manage outbound webhooks from your Laravel admin panel. The package itself is a thin UI and Eloquent layer on top of spatie/laravel-webhook-server, which handles payload signing, HTTP dispatch, and retries. In other words, you get an admin experience for webhook configuration without writing custom code.
- How do I install filament-webhook-server in a Laravel app?
- Install it with composer require marjose123/filament-webhook-server, then publish the migrations using php artisan vendor:publish --tag="filament-webhook-server-migrations" and run php artisan migrate. After that, register WebhookPlugin::make() inside the plugins array of your Filament panel provider. The whole install is a few minutes if you already have a working Filament panel.
- Which Laravel and Filament versions does this package support?
- The package is built for Laravel with Filament, but the README does not publish an explicit tested version matrix, so you should pin a release and verify against your current Filament major before rolling out. Because it subclasses Filament pages, a Filament major upgrade can break the UI layer. Record the resolved versions in composer.lock and test the plugin on a feature branch rather than using a floating constraint.
- Do I need a queue worker for webhooks to be delivered?
- Yes, practically speaking. The underlying spatie/laravel-webhook-server dispatches queued jobs, so you need a running queue worker for deliveries to actually go out. Without a queue you can install the package and configure webhooks, but the feature will not be usable in production. Make sure your queue connection and workers are healthy before relying on it.
- How does automatic model discovery work and should I allowlist models?
- By default every Eloquent model is offered as an option when creating a webhook, and you can adjust this with includeModels() and excludedModels() on the plugin. Automatic discovery creates an unintentional attack surface, since an admin could select a model containing PII and have it sent to an external endpoint. Replace auto-discovery with a deliberate allowlist and review exclusions before shipping to production.
- How are webhook signing secrets stored and can they be rotated?
- Signing secrets are handled by spatie/laravel-webhook-server and stored through the package's database tables created by the published migrations. The Filament page lets you configure the secret per webhook, and rotation is a matter of updating the value and updating the receiver. Confirm how the secret is masked in the UI and who on your team has panel access to view or change it.
- What does enableApiRoutes() expose and is it authenticated?
- Calling enableApiRoutes() on the plugin opens HTTP routes for the webhook feature, so you should verify how those routes are guarded in your Filament panel before enabling them. The package does not document an independent authentication layer, so the safe assumption is that route protection depends on your panel configuration. Treat this as a production footgun and review middleware and authorization policies explicitly.
- Does keepLogs() store full payloads and is there a pruning policy?
- Calling keepLogs() persists delivery history in a table so you can review past webhook activity in the history page. There is no evident retention or pruning command in the package, so the table can grow indefinitely and may store full payloads containing sensitive data. Plan a pruning or archival job yourself and check what is actually written into the history rows.
- Can I use custom pages or change the navigation for the webhook plugin?
- Yes. The plugin exposes a fluent chain including icon(), sort(), polling(), customPageUsing(), and enablePlugin() so you can control the navigation entry, polling interval, and swap in your own Filament pages. Passing webhookPage and webhookHistoryPage to customPageUsing() lets you subclass or restyle the defaults. Use this if you need to brand the pages or add authorization checks.
- Is filament-webhook-server production ready or should I use spatie/laravel-webhook-server directly?
- It is a low-adoption package with a single primary maintainer and no downstream ecosystem, so treat it as an admin-experience accelerator rather than a system of record for integrations. If you need guaranteed delivery semantics, per-tenant isolation, or a first-class subscription API, integrate spatie/laravel-webhook-server directly and skip the UI layer. If you are already on Laravel and Filament and want outbound eventing to be admin-configurable, it is a reasonable fit with pinning and an explicit model allowlist.