Weave Code
Laravel Mobile Pass Laravel Package
spatie/laravel-mobile-pass
Generate Apple Wallet and Google Wallet passes for boarding passes, event tickets, coupons, store cards, membership cards, and gift cards—with push updates to keep issued passes current on users' devices.
Generate mobile passes for iOS and Android
Frequently asked questions about Laravel Mobile Pass
- How do I install spatie/laravel-mobile-pass in a Laravel app?
- Install it with Composer using composer require spatie/laravel-mobile-pass, then publish and run the package migrations so the mobile_passes table exists. The package registers a standard Laravel service provider and ships config plus platform-specific builders for Apple and Google Wallet. After publishing the config, set your Apple and Google credentials and an HTTPS webservice host before generating passes.
- Which wallet pass types can I generate with this Laravel package?
- It generates Apple Wallet and Google Wallet passes for boarding passes, event tickets, coupons, store cards, membership cards, and gift cards. On the Google side it provides class and object builders for BoardingPass, EventTicket, Loyalty, Offer, and Generic pass types. Both platforms reference a persisted MobilePass record, so a pass maps to your order, ticket, membership, or balance entity.
- What Apple and Google credentials are required for mobile passes?
- For Apple you need an Apple Developer Program membership, a Pass Type ID certificate, and the Apple WWDR intermediate certificate. For Google you need a Google Wallet API issuer account and a service account. You also need a publicly reachable HTTPS host; the package throws InvalidConfig::webserviceHostMustBeHttps instead of emitting passes Apple would reject.
- Is spatie/laravel-mobile-pass compatible with my Laravel version?
- It is built as a standard Laravel package with an auto-discovered service provider, config, migrations, and a MobilePass model, so it fits normal Laravel applications. Check the exact Laravel and PHP constraints in the package's composer.json for the release you intend to pin. Pin versions and read UPGRADING.md on every bump because the package moved from 1.0 to 1.11.1 quickly, including a required schema migration at 1.0.5.
- How do live pass updates work, and should I queue them?
- The package treats a pass as a database-backed MobilePass record and dispatches platform-aware updates when the model changes, so Apple and Google passes reflect application state. PushPassUpdateJob can be queued by setting MOBILE_PASS_QUEUE_CONNECTION, which is the right choice for production so user requests do not block on wallet APIs. Keep updates idempotent and define an acceptable staleness window between your domain change and the pass refresh.
- How can I test mobile pass generation and live updates?
- Write feature tests around your own issuing flow: assert a unique, immutable serial per pass, the persisted MobilePass record, correct pass type, and that PushPassUpdateJob is dispatched when the model changes. Include explicit tests for zero-value fields such as prices, counts, and balances because a pre-1.8.1 bug dropped falsy scalars like "0" from Apple entities. Keep wallet network calls out of deterministic tests by queuing updates and asserting job payloads, then use sandbox credentials and the Spatie demo app for end-to-end checks.
- What production risks come with Apple and Google Wallet credentials?
- Credential lifecycle is the dominant risk: Apple Pass Type ID certificates expire annually and Google service-account keys rotate, and either failure can silently stop new installs and pass updates. The package hashes certificate contents into cached temp filenames since 1.0.3, but renewal ownership remains with your team. Name owners for renewal and monitor pass issuance and update jobs so expired credentials do not go unnoticed.
- What is stored in mobile_passes, and should I treat it as PII?
- The package persists a MobilePass record for each pass, and wallet integrations can retain device identifiers, push tokens, and callback payloads. Treat the mobile_passes table as PII-adjacent and review exactly which columns you need for issuance, updates, and audit. Define retention and deletion rules for device identifiers and push tokens, especially when a pass is revoked or a membership ends.
- How do I verify Google Wallet callbacks and handle public keys?
- Version 1.2.0 switched callback verification to ECv2SigningOnly, and automatic JWKS fetching is deferred, so you own Google public-key handling. A verification misconfiguration can silently drop GoogleMobilePassSaved and GoogleMobilePassRemoved events, so test the callback path with real signature fixtures. Also track Google class review status on updates, which 1.11.1 fixed, and alert on callback failures.
- Is spatie/laravel-mobile-pass production-ready, and what are the alternatives?
- It is vendor-supported but community-unproven: roughly 339 GitHub stars and zero Packagist dependents mean there is no public production reference beyond Spatie's own demo app. It is a strong fit when you need both Apple and Google Wallet passes backed by Laravel models and live updates. If you only need one platform or one pass type, generating passes directly with Apple PKPass tooling or the Google Wallet API may be simpler and avoids the package's fast upgrade churn.
Weaver
How can I help you explore Laravel packages today?