Weave Code
Laravel Agora Laravel Package
tomatophp/laravel-agora
Integrate Agora real-time voice and video into your Laravel app with ready-made helpers for channel and token generation, configuration management, and quick setup so you can add live audio and video features without writing boilerplate.
Laravel Agora brings Agora's real-time voice and video platform into your Laravel app, providing a clean, config-driven way to authenticate channels and connect users over RTC. It handles the boilerplate of app credentials, token generation, and channel setup so you can focus on building live audio, video, and streaming features instead of SDK plumbing.
- Config-driven App ID and certificate management
- Secure RTC/RTM token generation with expiry
- Publishable config for multi-environment setups
- Simple service API for controllers and Livewire
- Ready for voice, video, and live-streaming channels
Frequently asked questions about Laravel Agora
- How do I install and set up tomatophp/laravel-agora in a Laravel application?
- Install it with Composer, publish the package config, and set AGORA_APP_ID and AGORA_APP_CERTIFICATE in your .env file. From there you add one authenticated endpoint that returns a generated token, and the client SDK joins the channel with it. The evaluation estimates roughly an afternoon to get a real Web join working.
- Which Laravel and PHP versions does laravel-agora support?
- The package is assessed as a fit for Laravel 10 and 11 or newer on PHP 8 and above, alongside Composer and your existing auth stack such as Sanctum. Because it is a small adapter with no database, queue, middleware, or event surface, it composes with whatever middleware and policies you already run. Check the composer.json constraints on the exact tag you pin before committing to a version.
- How does laravel-agora generate Agora RTC tokens, and what goes into them?
- It mints an Agora RTC access token locally using an HMAC computation over your App ID, App Certificate, channel name, UID, role, and expiry, then exposes it through a Laravel service class. There is no network I/O, queue, or cache dependency in that path, so it is fast and stateless. The package itself ships no tests validating token shape, expiry, or privilege bits, so plan to write those assertions yourself.
- Is tomatophp/laravel-agora safe to use in production?
- Treat it as source you adopt rather than a platform you integrate. The evaluation flags a single maintainer, around 10 stars, zero dependents, and release metadata that appears future-dated, all on a path that signs credentials with your App Certificate, which fails most security reviews as a supply-chain risk. The suggested mitigations are to fork under MIT, pin a specific commit, assign an internal owner, and read src/ end to end before shipping.
- Does laravel-agora support Agora Chat, RTM, cloud recording, media push, or webhooks?
- The core scope is RTC token minting and channel authentication only. Chat and RTM messaging, recording, media push, webhooks, and multi-tenant App IDs are called out as explicit non-goals in the evaluation, so budget those separately if your roadmap needs them. Verify against the actual source whether any RTM helper exists before promising it to stakeholders.
- Does the token builder use Agora AccessToken v1 or v2, and is it vendored or a Composer dependency?
- This is an open question that must be closed before a go decision. Read src/ end to end to determine which AccessToken builder it wraps and whether that builder is a real Composer dependency on Agora's official library or a vendored copy. If it is vendored, you inherit a frozen schema snapshot and become responsible for tracking v1 versus v2 drift yourself.
- Why do my Agora tokens break after running php artisan config:cache?
- The known risk is env() being read at runtime instead of through config(), which only fails once configuration is cached. Confirm which pattern the package uses by reading the source, and run your CI pipeline with the config cached so this regression is caught before production. If it does read env() directly, wrap or patch it to resolve values through config().
- How do I handle App Certificate rotation and token revocation with laravel-agora?
- Agora's token model gives you no server-side revocation list, so short TTLs plus client-side renewal is your only revocation mechanism. A certificate rotation will cause 100% join failures that look like a client bug, so write a rotation runbook and add a synthetic scheduled join check in staging. Make sure the client handles expiry and renewal explicitly rather than treating a failed join as a network error.
- How should I test laravel-agora token generation?
- Since the package ships no tests, write a deterministic expiry test using a frozen clock and a privilege-bits test that asserts role and UID land where you expect. Treat "a token generates fine" as no evidence at all; the only real acceptance criterion is a successful join from each shipping client platform. Budget the spike at about two days with those exit criteria written down.
- Should I call laravel-agora directly from controllers or wrap it in my own contract?
- Wrap it behind an application-owned contract such as AgoraTokenIssuer so the vendor name appears in exactly one file. If the service leaks into controllers or Filament resources, every future change to token policy or UID derivation becomes a cross-cutting refactor. Also check whether the package exposes the underlying builder, since extending to wildcard channels, fine-grained privilege expiry, or per-tenant App IDs otherwise requires a fork.
Weaver
How can I help you explore Laravel packages today?