- How do I install paytabscom/laravel_paytabs in a Laravel app?
- Install it with Composer using paytabscom/laravel_paytabs, then publish the package config and optional migrations and set your PayTabs profile ID, server key, and region endpoint. The package provides routes and controllers for the hosted redirect and return handlers, plus a callback endpoint. Because the repository is archived, install it only for evaluation or as a forked, vendored dependency rather than a long-term production dependency.
- Is laravel_paytabs still maintained and safe for production?
- No. The repository is archived, has 24 stars and zero dependents, and will not receive security patches, Laravel compatibility updates, or fixes for PayTabs API changes. For production payments, treat it as a reference implementation and either fork and own the code or build a small first-party client against PayTabs REST API. Never Composer-require an archived payments library without accepting full maintenance ownership.
- Which Laravel and PHP versions does laravel_paytabs support?
- The wrapper uses standard Laravel config, service container, HTTP client, and Eloquent patterns, so developers on Laravel 9, 10, or 11 can read its surface area quickly. However, compatibility with newer Laravel majors, PHP 8.3+, and pinned PayTabs API versions is unverified and cannot be fixed upstream because the repo is archived. Test your exact Laravel and PHP versions in a fork before adopting it.
- How does the PayTabs hosted payment page flow work in Laravel?
- The package follows PayTabs hosted payment page model: it builds a payment request, redirects the customer to PayTabs, and uses a controller to handle the browser return URL. A separate callback endpoint is intended for server-to-server payment notifications. Card data never touches your servers, which keeps you in SAQ A scope, but your application must treat the callback, not the browser return URL, as authoritative.
- Does this package verify PayTabs callbacks and handle duplicate callbacks idempotently?
- Do not assume it does. Archived payment wrappers rarely implement rigorous signature verification, idempotency, duplicate-callback handling, or amount and currency reconciliation, and this package callback behavior must be verified line by line. Implement server-side signature checks against your PayTabs server key, deduplicate callback events, and reconcile the returned amount and currency with your own payment record before fulfilling an order.
- Can I handle refunds, recurring subscriptions, tokenization, and partial captures with this package?
- The package overview advertises refunds and recurring subscriptions with minimal setup, but small archived wrappers commonly leave voids, tokenization, partial captures, and full recurring lifecycle handling to the integrator. Mada, KNET, 3DS2, and Apple Pay specifics must be confirmed against PayTabs current API and tested in your target region. Assume you will build or harden any payment method or lifecycle feature your launch requires.
- Which PayTabs regions and payment methods such as Mada, KNET, 3DS2, and Apple Pay are supported?
- The package is configured with a PayTabs region endpoint, but it does not document verified coverage for every region or payment method. Mada, KNET, 3DS2, Apple Pay, and recurring payments depend on your PayTabs profile, commercial agreement, and current API capabilities, not just the wrapper. Confirm the required regions and methods directly with PayTabs and test each one in sandbox before committing.
- Should I use this package or build a custom PayTabs REST API client?
- Prefer building a thin first-party PayTabs REST client, roughly 200 to 400 lines to build the request payload, POST, redirect, handle the return, and verify and process callbacks. That removes the abandonment risk of an archived dependency and leaves you owning only the code you need. If timeline pressure forces reuse, fork the package, vendor it into your repository, pin the version, and strip the Composer dependency rather than requiring the archived library.
- How should I store PayTabs profile ID, server key, and region configuration securely?
- The package typically leaves secrets handling to the integrator, so store the PayTabs profile ID and server key in environment variables or a secrets manager, never in committed config. Use separate per-region configuration where required, restrict key access, and have a rotation plan. Because the repo is archived, you must also own any config changes needed when PayTabs endpoint or credential requirements change.
- How do I test PayTabs payments, return URLs, and callbacks in Laravel?
- Use PayTabs sandbox credentials and test the complete hosted redirect, browser return, and server callback flow, including duplicate callbacks, failed payments, amount and currency mismatches, and 3DS or region-specific methods. Assert that order fulfillment happens only after a verified callback, not on the return URL. Add automated tests around idempotency and reconciliation, and repeat them in a forked or first-party implementation because upstream fixes will not arrive.