- How do I install nextapps/laravel-swagger-ui in a Laravel application?
- Install it with Composer using composer require nextapps/laravel-swagger-ui, then publish the package config and Swagger UI assets with the vendor:publish command. Point the config at the path or URL of your OpenAPI or Swagger JSON/YAML spec and visit the configured docs route. Most teams also add an environment gate so the route only exists outside production. The whole setup is a spike-sized task, typically hours rather than a sprint.
- Does this package generate my OpenAPI specification automatically?
- No. It is a presentation-layer package that only renders Swagger UI and points it at an existing spec file, so it solves the last mile of documentation and nothing upstream. You still need a source of truth such as hand-maintained YAML, l5-swagger with swagger-php annotations, Scribe with an OpenAPI export, or a CI step that emits the spec. Decide on that generator before scoping this package in.
- Which Laravel and PHP versions does laravel-swagger-ui support?
- The package is deliberately thin: a service provider, a route, a Blade view, and a static Swagger UI bundle, so it is broadly compatible across modern Laravel releases. Confirm the exact Laravel and PHP matrix in the package's composer.json and CI configuration before pinning a version. If your application runs an older Laravel release, verify the service provider and route registration conventions still match.
- Are the Swagger UI assets served locally or loaded from a CDN?
- The package ships Swagger UI's static bundle and assets are published into your application, which keeps docs independent of a Node or Vite build step. Check the published config and view to confirm exactly which paths or URLs the UI is loaded from in your version. If anything is CDN-sourced, vendor it locally so air-gapped environments and strict Content-Security-Policy headers do not break the page.
- How do I stop the Swagger UI docs route being publicly reachable in production?
- Documentation routes are a well-known information-disclosure surface, so treat a default-open /docs route in production as a security finding waiting to be filed. Gate the route behind an environment check in config and attach middleware or an auth guard for internal-only access. The package exposes route-level hooks for middleware and guards, so you can restrict it to staff, a VPN, or a signed-in admin without forking the code.
- Why is my Swagger UI page blank or showing nothing?
- The most common cause is a Content-Security-Policy header blocking Swagger UI's inline initialization script, which looks like a broken package to anyone who has not opened the browser console. Check the console for CSP violations and allow the script via a nonce, hash, or adjusted policy. Also confirm your spec path resolves correctly, because an unreachable or malformed JSON/YAML file renders an empty page too.
- Can I host multiple specs, like a public API and an internal partner API, in one Laravel app?
- Multiple-spec support is not documented as a first-class feature, so verify what your installed version's config actually allows before designing around it. Common approaches are separate config entries with distinct routes, or mounting the package route once per spec with different middleware. If you genuinely need several specs, test it during the spike rather than assuming it works out of the box.
- Does it support OpenAPI 3.1 specifications?
- OpenAPI 3.1 rendering depends entirely on the Swagger UI bundle version the package ships, so check which version is pinned before relying on it. If your generator emits 3.1, load a real spec and confirm every endpoint, schema, and example renders correctly. If 3.1 features break, either downgrade your generator output to 3.0 or upgrade the bundled Swagger UI assets.
- Can I use OAuth2 or the Try it out button against a secured API?
- Try it out is a Swagger UI feature, and it works when your spec declares security schemes and the package passes the relevant Swagger UI configuration through. For OAuth2 or PKCE flows you need the correct authorization and token URLs in the spec plus CORS configured on the API so the browser can call it. Test the flow end to end during the spike, since browser-side auth failures are easy to misdiagnose as a rendering problem.
- Is nextapps/laravel-swagger-ui safe to depend on, and how does it relate to l5-swagger?
- It is a small convenience dependency rather than a strategic one: roughly 281 stars and zero dependents, and the repository is a personal fork under the wotzebra account while the package name is nextapps, so confirm which namespace you actually install and who holds release rights. Pin an exact version and vendor the asset bundle if it comes from a CDN. It is not a replacement for l5-swagger or Scribe, but it can replace just the UI rendering layer while your existing generator keeps producing the spec.