- How do I install soap/laravel-omise-webhooks in a Laravel app?
- Install it with Composer using composer require soap/laravel-omise-webhooks. Laravel's package auto-discovery registers the service provider, so no manual provider entry is normally needed. After installing, publish the package config with php artisan vendor:publish and add your Omise keys. Then point your Omise dashboard webhook URL at the route the package registers.
- Which Laravel versions does this package support?
- Version 1.2.0 added Laravel 13 support by widening its illuminate/* constraints, and the release contains no removals or deprecations. Widened constraints usually mean additive support for older lines rather than a drop, but you should confirm the exact matrix in the package's composer.json before pinning. Also check the PHP floor implied by the Laravel versions you target.
- Does the package verify that incoming Omise webhooks are authentic?
- The package is described as verifying incoming events before dispatching them to your handlers, which is the core reason to use it rather than writing a raw controller. Because webhook verification is security-critical, read the actual controller and verification code during evaluation instead of relying on the description. Confirm whether it checks an Omise signature or token and whether it fails closed on mismatch.
- Does it handle idempotency or duplicate webhook deliveries?
- The package's stated scope is receiving, verifying, and dispatching events; it does not own payment state, which stays in your application. That means deduplication and idempotency are generally your responsibility, for example by storing processed event IDs and short-circuiting repeats. Plan for replay and out-of-order delivery in your own handlers regardless of what the package does.
- What Omise events can I handle with this package?
- The package dispatches Omise webhook events to your handlers so you can react to charges, refunds, and other event types without writing boilerplate. Which events actually reach you depends on which ones you subscribe to in the Omise dashboard. Your handlers should treat unknown or unsubscribed event types defensively rather than assuming a fixed set.
- How do I test Omise webhooks locally before going live?
- Register the package route in your application, then expose your local environment through a tunnel so Omise can reach the endpoint. Trigger test events from the Omise dashboard or test-mode API and confirm your handler receives and processes them. Point the Omise endpoint at staging first and verify end to end before switching production over.
- Should Omise webhook handling run on a queue in production?
- Yes, it is a good practice to have the package's event dispatch feed your existing queue worker so webhook handling is asynchronous and retryable. Omise expects a prompt HTTP response, and slow handler work inline risks timeouts and retried deliveries. Combined with idempotent handlers, queued processing makes retries safe rather than duplicative.
- Is this package safe to use on a payment-critical path?
- It is architecturally narrow, sitting at the inbound edge of the payments domain, with payment state remaining in your application, so it can be adopted or replaced without restructuring domain code. The main concerns are inherent to webhook handling, such as verification, replay protection, and ordering, plus the fact that it is maintained by a single author. Consider a fork or vendoring contingency given the bus factor.
- How is the package maintained, and is the project active?
- Recent 1.2.0 work added Laravel 13 support and routine Dependabot CI action bumps, with no API changes or deprecations. Maintenance tracks a single maintainer, so check release cadence and issue-response history before depending on it for payments. The CI toolchain is loosely pinned, which is worth noting but does not affect runtime consumers.
- Can I skip the package and implement Omise webhooks myself?
- Yes, the package is thin enough that a custom controller plus a verification check is a realistic alternative if you want full control. The tradeoff is that you reimplement verification, routing, and dispatching boilerplate, which is exactly what this package removes. If you do build your own, plan idempotency, replay protection, and out-of-order event handling from the start.