- How do I install robrichards/wse-php in a Laravel application?
- Run composer require robrichards/wse-php and make sure ext-soap and ext-openssl are enabled in every runtime image. The package has no Laravel service provider, facade, config file, or published assets, so installation is just Composer plus your own integration wrapper. A typical first working signed request against a partner sandbox takes one to three days, with most effort spent on certificates, WSDL handling, and endpoint configuration.
- Is robrichards/wse-php a Laravel package with a service provider or facade?
- No. It is a framework-agnostic, low-level WS-Security library that decorates native ext-soap classes such as SoapClient, SoapVar, and SoapHeader. It has no container awareness and no Laravel version constraints. In Laravel, put it behind an anti-corruption layer such as a WsseSoapClient wrapper resolved from the container so application code never uses RobRichards\WsePhp classes directly.
- Can I use robrichards/wse-php with Laravel's HTTP client?
- No. Laravel's Http facade cannot produce WS-Security SOAP envelopes, so Http::withHeaders() is not a substitute for a signed SOAP request. You need a native SoapClient decorated with WS-Security headers, signatures, and possibly encryption. Retry, middleware, and telemetry patterns must be reimplemented around that blocking SOAP call.
- Which Laravel and PHP versions does robrichards/wse-php support?
- The package is not Laravel-specific, so it has no Laravel version constraints and no facade conflicts. It is a Composer PHP library, so check its current composer.json and tag history to confirm PHP 8.x compatibility rather than relying on maturity scores. Validate it in your target local, CI, staging, and production images with ext-soap and ext-openssl present.
- How do I sign a SOAP request with WS-Security in Laravel?
- Wrap native SoapClient in your own service, add the required BinarySecurityToken and security headers, and sign the SOAP envelope using the library's XML Digital Signature support. Pin the algorithm suite explicitly to RSA-SHA256 and SHA-256 rather than relying on defaults, and confirm what the counterparty accepts. The library works in WSDL and non-WSDL mode, which helps when partner WSDLs are broken or unavailable in lower environments.
- Does robrichards/wse-php support encryption, decryption, Timestamp, and UsernameToken?
- Yes. It supports XML Encryption for encrypting and decrypting SOAP payloads, XML Digital Signatures for signing and verification, and WS-Security headers including Timestamp and UsernameToken. It also supports BinarySecurityToken and X.509 certificate-based security. Incoming requests can be verified and decrypted using the same XML Security standards.
- How should I manage certificates and private keys for WS-Security in Laravel?
- Keep private keys and passphrases in a secrets manager or mounted volume rather than committing them or storing them only in .env. Define a certificate lifecycle owner and rotation runbook, because short-lived certificates and clock drift are common production incidents for this type of integration. Treat key material and any mutable signature state as request-scoped, especially under Octane.
- Is robrichards/wse-php safe to use with Laravel Octane?
- The library is stateless per call, but SoapClient instances and per-request key material must not be shared across requests. Never register a client with mutable signature state as a singleton in the container. Resolve a request-scoped WsseSoapClient wrapper for each job or request and keep signature, timestamp, and certificate state isolated.
- How do I test a WS-Security SOAP integration built with robrichards/wse-php?
- Unit-test the generated envelope with fixtures and assert the security headers, signature algorithm, canonicalization, and timestamp values. Verify signatures and decryption against test certificates rather than production keys. Run integration tests against the partner sandbox, because WS-Security failures often appear as generic SOAP faults and are hard to diagnose from application logs alone.
- What are the alternatives to robrichards/wse-php for Laravel SOAP integrations?
- First confirm whether WS-Security is required, because mTLS, OAuth2, or HMAC-signed REST is usually cheaper and simpler than message-level SOAP security. If WS-Security is mandatory, robrichards/wse-php paired with robrichards/xmlseclibs is a common open-source choice, while commercial SOAP and WS-Security products offer support and maintenance. Because the package is MIT-licensed, small, and single-maintainer, you can also vendor or fork it if maintenance stops.