Weave Code
Laravel Sqids Laravel Package
red-explosion/laravel-sqids
Laravel Sqids generates short, unique, obfuscated IDs from integer keys, keeping database IDs hidden in URLs and APIs. Includes route model binding, validation rules, and simple configuration for a seamless drop-in integration.
Easily generate Stripe/YouTube looking IDs for your Laravel models.
Frequently asked questions about Laravel Sqids
- What is red-explosion/laravel-sqids used for?
- It is a thin Laravel integration around the Sqids PHP library that generates short, reversible, non-sequential IDs from integer primary keys. It is useful when you want to hide database IDs in URLs, APIs, or exports without switching away from integer keys. Treat it as ID encoding, not encryption or access control.
- How do I install red-explosion/laravel-sqids in a Laravel app?
- Install it with Composer using composer require red-explosion/laravel-sqids. The package uses Laravel auto-discovery, so the service provider should be registered automatically. Publish the configuration file and set a stable salt and alphabet per environment before generating IDs.
- Does laravel-sqids support Laravel 13?
- Yes, version 2.1.0 is a compatibility release that adds Laravel 13.x support. It should remain a safe additive upgrade for Laravel 10 through 12 applications, but confirm that the updated constraints do not unexpectedly raise your minimum Laravel or PHP version. Check transitive dependency constraints in a branch before deploying.
- How do I configure the Sqids salt and alphabet?
- After publishing the package config, set the salt and alphabet values per environment. Keep the salt stable because rotating it changes generated IDs and invalidates previously issued public identifiers. Store and manage the salt like other application configuration, and document who owns it.
- Does the package include route model binding and validation rules?
- Yes, the package includes route model binding and validation rules for a seamless drop-in integration. That lets you accept short public IDs in routes and form requests while resolving or validating the underlying integer keys. Check the README for exact usage examples and whether Eloquent casts are also provided.
- Are Sqids reversible, and can I use them for security or authorization?
- Sqids are reversible encodings, not encryption, so they must not be treated as secrets or authorization tokens. They make IDs shorter and less enumerable but do not replace policies, signed URLs, rate limiting, or other access controls. Use them for internal or low-risk public identifiers only.
- What happens if I rotate the Sqids salt in production?
- Rotating the salt changes the mapping between integer keys and encoded IDs, so previously issued public IDs will no longer decode to the same values. Plan salt rotation carefully and consider a migration or compatibility strategy for existing links. Keep the salt stable unless you intentionally want to invalidate old identifiers.
- How should I handle invalid or undecodable Sqids?
- The package wraps sqids-php, so decode behavior follows that library and may be nullable or exception-based depending on the version and call path. Validate incoming IDs at the boundary and confirm the expected error contract in your application tests. Do not assume every incoming Sqid will decode successfully.
- Can I use laravel-sqids alongside UUIDs or ULIDs?
- Yes, Sqids complement UUIDs and ULIDs rather than replacing them. You can keep UUIDs or ULIDs for high-risk or distributed identifiers while using Sqids for shorter public representations of integer keys. Choose the identifier strategy that matches each model and exposure level.
- Is red-explosion/laravel-sqids actively maintained and what are the main risks?
- It is a small package with low ongoing maintenance, and version 2.1.0 is primarily a framework-compatibility update. The main risks are architectural: salt or config leakage, salt rotation invalidating issued IDs, assumptions that encoded IDs are unguessable, and database column sizing for encoded strings. Pin versions with Composer, track upstream Laravel and Sqids PHP releases, and document that Sqids are not authorization tokens.
Weaver
How can I help you explore Laravel packages today?