Weave Code
Laravel Webhook Server Laravel Package
spatie/laravel-webhook-server
Send webhooks from your Laravel app with ease. Configure endpoints, sign outgoing calls, and automatically retry failed deliveries using customizable backoff strategies. Pairs with spatie/laravel-webhook-client for receiving webhooks.
spatie/laravel-webhook-server is a Laravel package for sending outgoing webhooks to other applications when events occur in your app. Instead of writing HTTP client code by hand, you define webhook calls as classes and let the package handle delivery, signatures, and failures — communicating with other apps via simple HTTP requests.
- Signed calls — cryptographically sign outgoing requests so receivers can verify authenticity
- Retries & backoff — automatically retry failed deliveries with configurable backoff strategies
- Queued delivery — dispatch webhooks through Laravel queues for async, non-blocking sends
- Configurable HTTP client — customize headers, timeouts, and request options per webhook
- Simple, testable API — class-based webhooks that are easy to define, reuse, and test
Pairs with laravel-webhook-client for receiving webhooks.
Frequently asked questions about Laravel Webhook Server
- How do I send a webhook from a Laravel app with spatie/laravel-webhook-server?
- Install it with composer require spatie/laravel-webhook-server and publish the config file. Then build a call with WebhookCall::create(), set the URL and payload, and dispatch it. The package queues a job that signs and sends the HTTP request, so configure a real queue worker rather than using the sync driver in production.
- Does spatie/laravel-webhook-server support signing webhook requests?
- Yes. By default it signs the JSON-encoded payload with HMAC-SHA256 using your secret, and you can swap in a custom Signer implementation. Timestamping is opt-in via useTimestamp(), so enable it if you need replay protection and make receivers enforce a tolerance window. Receivers should verify the signature against the raw request body.
- How are failed webhooks retried and can I customize the backoff strategy?
- Failed calls are retried by the queued job according to a BackoffStrategy, with a default ladder of about 10 seconds, 100 seconds, and 1000 seconds across three tries. You can pass a custom strategy with useBackoffStrategy(), change maximumTries(), and set timeoutInSeconds() per call. Remember that retries depend on delayed queue dispatch and that SQS caps delays at 15 minutes.
- Which Laravel versions does spatie/laravel-webhook-server support?
- The package does not publish a fixed Laravel version matrix in this context, so check its composer.json and Packagist metadata for the current constraints before upgrading. It relies on Laravel queues and events, so use a supported Laravel version with a working queue backend. Pin the package version explicitly in production because release metadata signals should not be treated as reliable.
- Can I use laravel-webhook-server for customer-configurable webhook endpoints?
- No. The package is an outbound webhook primitive: it sends one payload to one endpoint and does not provide self-serve endpoint registration, per-endpoint event filtering, replay controls, or delivery history. If customers must configure their own webhook subscriptions, build that registry and audit layer around this package or choose a webhook platform.
- How do I test webhooks sent by spatie/laravel-webhook-server?
- Use Queue::fake() and assert that CallWebhookJob was pushed with the expected URL and payload for your domain event. Use Http::fake() when you need to inspect the outbound request and headers without hitting a real endpoint. Also test your receiver's signature verification against the raw body, because re-encoding JSON can break HMAC checks.
- Does laravel-webhook-server guarantee exactly-once webhook delivery?
- No. Delivery is at-least-once, so a retry after a timeout or non-2xx response can duplicate a webhook that the receiver already processed. The package does not add an idempotency key automatically; add one with withHeaders() and require the receiver to deduplicate. For auditability, persist your own delivery attempt and outcome records.
- What should I configure before using laravel-webhook-server in production?
- Run webhook delivery on a real asynchronous queue with workers, not the sync driver, so request latency and retries do not block your app. Configure signing, enable timestamps if needed, set timeouts and retry limits deliberately, and account for SQS's 15-minute delayed-dispatch ceiling. Store secrets securely and add persistence plus alerting if you need to answer whether a specific delivery succeeded. Pin versions and monitor final failure events.
- How do I add custom headers or an idempotency key to a webhook?
- Use withHeaders() on the WebhookCall builder to pass an associative array of custom headers. For idempotency, generate a stable unique value per logical event and send it as a header such as X-Idempotency-Key. The receiver must enforce deduplication against that key, because the package does not provide idempotency semantics itself.
- Is spatie/laravel-webhook-server maintained and what alternatives exist?
- It is a Spatie package with a small, focused API and interface-based extension points, but project signals are sparse, so pin versions and review release metadata carefully. Alternatives include writing a small queued job around Laravel's HTTP client, using a full webhook platform for customer-managed subscriptions, or pairing this package with spatie/laravel-webhook-client when you also need to receive webhooks. Evaluate maintenance activity in the repository before making it a long-term dependency.
Weaver
How can I help you explore Laravel packages today?