- How do I install mendicm/sermepa-omnipay with Composer?
- Install it with Composer alongside Omnipay core, typically via composer require mendicm/sermepa-omnipay and omnipay/common. This is an Omnipay gateway driver, not a Laravel package, so do not expect Laravel auto-discovery or a published config file. In Laravel you will need to bind the gateway in your own service provider or use an Omnipay bridge.
- Does this package work with Laravel?
- It is a framework-agnostic Omnipay driver, not a native Laravel package. You can use it in Laravel, but you must add Omnipay core plus a bridge or custom container binding, and you own the controller and routes for the Redsys form post and notification callback. Laravel's Cashier and native gateway SDKs do not use Omnipay, so this implies maintaining a parallel payment abstraction.
- How do I configure the Sermepa/Redsys gateway?
- Instantiate the Omnipay gateway with your Redsys merchant code, terminal, secret key, and sandbox or production endpoint, following the package README for exact parameter names. You will also need your own controller to render the auto-submitting form and to receive the server-to-server notification containing Ds_MerchantParameters and Ds_Signature. Treat configuration and callback handling as application code you must test against the Redsys sandbox.
- Does it support Redsys HMAC_SHA256_V1 signatures or only the legacy SHA-1 scheme?
- This is not confirmed from the package overview, and it is the first thing to verify in the source and sandbox. The package name references Sermepa, a brand that has been Redsys for roughly a decade, which raises concern that it may target the legacy SHA-1 signature scheme rather than current HMAC_SHA256_V1 with its parameter-ordering requirements. If it only implements SHA-1, that is a hard blocker for production.
- Is 3DS2/SCA challenge handling supported?
- The driver exposes only what Omnipay models, such as purchase, authorize, capture, and refund, and the overview does not document Ds_Merchant_EMV3DS or 3DS2 step-up handling. Redsys has moved to SCA/3DS2 under PSD2, so EU cardholders may require a challenge flow the driver does not expose. Plan for custom work and sandbox testing before relying on it for compliant card payments.
- How should I handle the Redsys notification callback in Laravel?
- Create a POST route outside CSRF protection, read Ds_MerchantParameters and Ds_Signature, verify the signature, and update the order idempotently before returning the expected response to Redsys. The driver may help build or parse messages, but you own the glue code, retry handling, and reconciliation against the Redsys admin panel. Budget roughly 200 to 400 lines of application code and tests for a production-grade integration.
- Does it support refunds, partial refunds, and tokenization?
- The Omnipay models generally cover purchase, authorize, capture, and refund, which is usually sufficient for the Redsys redirect flow. Tokenization, recurring payments, COF, and partial-refund edge cases are not addressed by the overview and likely require custom work. Verify each operation against the Redsys sandbox and confirm how the driver constructs and validates signatures for refunds.
- Is this package safe and maintained enough for production?
- Treat it as high risk: the overview notes zero stars, zero dependents, and no endorsement, while card-flow signing and callback validation are security-critical. An unmaintained driver with a single signature bug could become a PCI or PSD2 incident. If you adopt it, fork or vendor the code, review the signing and verification logic, and be prepared to own fixes.
- What are the alternatives for Redsys payments in a Laravel app?
- Evaluate the official Redsys PHP SDK, a maintained Laravel Redsys package, or a small client you own before falling back to this driver. Laravel Omnipay bridges are largely dormant, so a custom service provider is likely either way. Choose this package only if you have deliberately standardized on Omnipay and can verify SHA-256 signing, callback verification, and 3DS2 against the Redsys sandbox.
- Does it support PHP 8.x, and does it have automated tests?
- PHP version support and test coverage are not stated in the overview, and an unmaintained package may predate PHP 8.x. There is no evident automated or Redsys sandbox test suite, so run Composer checks and your own sandbox scenarios before trusting it. Also review the last commit date and open security issues, and decide who owns the code if it breaks in production.