- How do I install sirumobile/siru-php-sdk in a Laravel app?
- Install it with composer require sirumobile/siru-php-sdk, then bind the client as a singleton in a service provider and read credentials from config. Because the SDK is a thin API client, expect to write that provider and config file yourself rather than relying on package auto-discovery for anything beyond the class itself. Use SIRU_ prefixed environment variables locally, but keep production credentials in a secrets manager instead of .env.
- Is sirumobile/siru-php-sdk still maintained?
- Treat it as unmaintained until Siru confirms active stewardship: the last release was 2021-12-22 and it shows zero stars and zero dependents. There is no visible changelog, support policy, or security disclosure process, and no evidence of anyone running it in production. If you adopt it, pin the version and plan to fork or vendor the code.
- Is sirumobile/siru-php-sdk compatible with Laravel 10 or 11 and PHP 8.2?
- The repository does not publish a clear PHP and Laravel support matrix, and its 2021 dependency constraints may conflict with current Laravel skeletons or force older Guzzle versions. Check composer.json against your PHP and Laravel versions in a scratch branch before committing, and watch for abandoned transitive dependencies. A conflict on Guzzle is the most likely blocker on modern stacks.
- Does the SDK support the current Siru Mobile API version?
- The package description does not state which Siru API version it targets, so verify this against Siru's current documentation before building on it. Confirm that it covers the calls you need, such as payment initiation, status, refund, cancel, and settlement reporting, and that it implements the current request signing scheme. A 2021 SDK against a live payment API is a real risk of speaking a deprecated version.
- Does the SDK verify Siru webhook or callback signatures?
- Assume signature verification is not provided unless you can read the code and confirm it, and check that any comparison is constant-time and replay-safe. For a payment callback, verify the signature and replay window in your own application layer, then hand a normalized event to your domain code. This keeps the security-critical path under your control if the package is abandoned.
- Should I use the SDK directly in my controllers and models?
- No. Injecting the SDK into controllers, models, or jobs leaks its DTOs, status enums, and HTTP exceptions across your codebase and makes replacement expensive. Wrap it in a single adapter class that implements your own PaymentGateway interface, with Siru-specific mapping isolated in that one file. Checkout, order, and reconciliation logic then stay unchanged if you later swap to a direct HTTP client or another provider.
- How do I test Siru Mobile payments without hitting production?
- There is no visible CI or test suite in the package, so plan to test the integration yourself using Siru's sandbox credentials and recorded fixtures. Point the SDK at the sandbox base URL and assert your adapter's mapping rather than the SDK internals. For checkout flows, faking your own PaymentGateway interface is the cheapest way to test without network calls.
- Does the SDK handle idempotency, retries, and timeouts?
- Do not expect idempotency keys, retry policies, or request timeouts from a thin vendor SDK; assume you must implement them. Send an idempotency key derived from your own order identifier, set explicit timeouts, and retry only on safe transient failures. These guarantees belong in your application layer regardless of what the package ships.
- Can I fork sirumobile/siru-php-sdk, and what are the alternatives?
- The SDK is MIT licensed, so you can fork it into app/Support/Siru or a private VCS repository, patch it, and pin it without upstream cooperation. The fallback is to reimplement a small client with Laravel's HTTP client against Siru's documented REST API, which is typically only a few hundred lines. Either path limits the blast radius if the package is abandoned.
- What should I check before running this payment SDK in production?
- A payment SDK sits on a trust boundary, so review how it handles credentials, request signing, and logging before going live. Redact MSISDNs, tokens, and payment identifiers from logs, and load credentials from a secrets manager rather than .env. Keep audit trails and reconciliation evidence, since carrier billing still carries a regulatory surface even with lower PCI scope than card acquiring.