Weave Code
Redsys Bundle Laravel Package
paymentsuite/redsys-bundle
A PHP bundle for integrating the Redsys payment gateway into Symfony applications, with helpers for signed payment requests, merchant notifications, and response handling to simplify Redsys checkout flows.
Redsys PaymentSuite Component
Frequently asked questions about Redsys Bundle
- Can I install paymentsuite/redsys-bundle in a Laravel application?
- No. It is a Symfony bundle and a read-only subtree split of a component inside the PaymentSuite monorepo, and it only works inside PaymentSuite's abstraction alongside paymentsuite/core and paymentsuite/payment-bundle. A Laravel app has none of that scaffolding, so requiring it into app/ will not give you a working Redsys integration. Treat the repository as reference code to port, not a dependency to install.
- Does paymentsuite/redsys-bundle use HMAC-SHA-256 or the deprecated SHA-1?
- That is the go/no-go question and it can only be answered by reading the signing code. Redsys mandated HMAC-SHA-256 in 2018 and deprecated SHA-1, so a bundle that still signs with SHA-1 is unusable in production without a fork. Check both the signature generation and verification paths before committing to any spike.
- What PHP and Symfony versions does this Redsys bundle require?
- The composer.json constraints are not documented in the overview, and given the project's vintage you should expect Symfony 2.x or 3.x era requirements rather than a modern LTS. Run composer why-not against your PHP and Symfony targets to see the real conflicts. Compatibility with current Symfony must be tested, not assumed.
- Is paymentsuite/redsys-bundle a general-purpose Redsys SDK?
- No. It is the Redsys (Sermepa / TPV Virtual) payment-method plugin for PaymentSuite Core, not a standalone SDK. It registers a payment method implementing PaymentMethodInterface and pushes order and payment records through PaymentSuite's managers. Outside that architecture what you get is domain logic for parameter assembly, signing and callback verification, not a ready-to-call API.
- How should I integrate Redsys into Laravel if this is a Symfony bundle?
- Port the useful parts into a Laravel service behind your own PaymentGateway interface: signed parameter assembly, HMAC signature generation, and callback signature verification. Running a Symfony kernel alongside Laravel just for this integration is disproportionate. Alternatively, use a maintained Redsys SDK or an Omnipay Redsys driver behind the same interface.
- Does the bundle support the Redsys Sis-Test sandbox environment?
- It switches between test and production environments via configuration, which is the hook you need for Sis-Test. Whether the sandbox endpoints and separate test credentials are wired correctly is something you must confirm in the code. Run the full checkout and notification flow against Sis-Test before trusting it.
- Does it verify Redsys callback signatures, and is it idempotent on duplicate notifications?
- The bundle validates HMAC signatures on Redsys callback notifications, so a server-side verification path exists in some form. Idempotency is not stated anywhere: Redsys can send the same notification more than once, and your order handling must be safe to reprocess. Implement that in your own application rather than assuming the bundle covers it.
- Is paymentsuite/redsys-bundle actively maintained and safe for production?
- Assume you are the maintainer from day one. The repository has roughly 2 stars, 0 dependents, no downstream validation, and issues and contributions route to an upstream monorepo you do not control. It is also a generated read-only subtree split, so security fixes may lag or never land here, meaning the supply-chain review is yours.
- Does this bundle keep card data off my servers for PCI scope?
- The flow is redirect-based: you build a signed request, redirect the customer to the secure Redsys form, and receive a notification back. That keeps card data out of your application and keeps you near a SAQ-A style scope. Verify that no code path touches PAN or stores card details before relying on that claim.
- Are there tests, CI, or published test vectors, and what license is it under?
- The bundle is declared MIT, but license hygiene still requires a per-file header check across any vendored code. There is no indication of a test suite, CI pipeline, or published test vectors, so plan to write your own tests using Redsys test vectors as part of any port. That effort belongs in your estimate before the spike starts.
Weaver
How can I help you explore Laravel packages today?