- How do I install marshmallow/laravel-facebook-webhook in Laravel?
- Install it with Composer using composer require marshmallow/laravel-facebook-webhook, then publish the package config, typically with php artisan vendor:publish. Set your Meta app ID, app secret, verify token, and Page access token in .env. Laravel package discovery should register the service provider automatically. Confirm the webhook route and handler wiring in the published config before pointing Meta at your HTTPS endpoint.
- Does this package verify Facebook webhook signatures and the hub challenge?
- Yes. The package description states that it verifies the hub challenge on GET requests and validates X-Hub-Signature payloads on POST callbacks, which is the baseline for a Facebook webhook endpoint. You should still confirm in the code and tests that a signature mismatch fails closed with a 403 and that the raw request body is used for the HMAC check. Treat that verification as security-critical, because the endpoint receives lead notifications tied to your Meta app.
- How do I retrieve Facebook Lead Ads data in Laravel with this package?
- The package's stated purpose is to retrieve Facebook Leads via webhooks and the Graph API; the webhook notification carries a leadgen_id that is resolved through a Graph API call using a Page access token. In a Laravel app, route that event into a queued handler and persist the resolved lead to your CRM. Store the raw payload as well, because Meta's lead retention is limited and any ingestion gap becomes permanent data loss.
- Which Laravel and PHP versions does this package support?
- The package is aimed at modern Laravel applications, and the TPM assessment frames the fit as Laravel 10, 11, or 12 on PHP 8.1 or newer. The authoritative constraints are in the package's composer.json and README, so check those before upgrading or adopting it. If you are on an older Laravel version, verify compatibility explicitly rather than assuming it.
- Does it process Facebook leads in a queue or call the Graph API inline?
- The package routes incoming webhook events to your own handlers, so it does not make queuing decisions for your application. You should dispatch a job from the handler and call the Graph API there rather than doing network work inline in the webhook request. Meta expects a fast 200 response and will retry on timeouts, so inline Graph API calls increase duplicate-delivery risk.
- Is marshmallow/laravel-facebook-webhook production ready and actively maintained?
- Treat it as unproven for production until you have audited it. Public signals are thin: roughly thirteen stars, zero dependents, and a single-package maintainer profile, which means little downstream stress-testing and no community to surface edge cases. The anomalous last-release date should be verified rather than read as proof of active maintenance. Have a fork plan and a named internal owner if you adopt it.
- How do I configure Facebook app credentials and Page access tokens?
- Configuration is expected to be a publishable config file plus environment variables for the Meta app ID, app secret, verify token, and Page access token. Use a long-lived Page token and document how it is refreshed and stored, because expired tokens silently break lead retrieval. Keep the app secret and tokens out of version control and restrict who can read them.
- How do I prevent duplicate Facebook leads and handle webhook retries?
- Facebook can deliver the same webhook more than once, and Meta retries failed deliveries, so make lead ingestion idempotent on leadgen_id. Add a unique constraint or dedupe check before writing to the CRM, store the raw payload for replay, and use queued jobs with retry and backoff. The package can route events, but duplicate prevention and persistence are application responsibilities.
- How do I test Facebook webhook handling in Laravel?
- Test the GET verification handshake by sending the expected hub.mode, hub.verify_token, and hub.challenge parameters and asserting the challenge is echoed. For POST callbacks, compute a valid X-Hub-Signature-256 HMAC with your test app secret, assert invalid signatures are rejected, and fake the Graph API call with Laravel's HTTP client fakes. Also use Queue::fake to confirm your handler dispatches the lead-processing job.
- What are the alternatives to this Laravel Facebook webhook package?
- Alternatives include writing a small Laravel controller and middleware yourself for the hub challenge, HMAC verification, and event routing, or using Meta's official SDKs for the Graph API calls. General webhook-receiving packages can handle signature plumbing, but you will still write the Facebook-specific verification and lead retrieval logic. Evaluate this package mainly on whether it saves enough boilerplate to justify taking on an unproven dependency.