Weave Code
Graphql Php Laravel Package
webonyx/graphql-php
A PHP implementation of the GraphQL specification, based on the JavaScript reference implementation. It's fully compliant with the October 2021 spec, with September 2025 compliance in progress, and supports schema building, query execution, and validation.
A PHP port of GraphQL reference implementation
Frequently asked questions about Graphql Php
- What is webonyx/graphql-php and how does it work with Laravel?
- webonyx/graphql-php is a PHP port of the GraphQL reference implementation, fully compliant with the October 2021 specification and with September 2025 compliance in progress. It gives you schema building, query parsing, validation, and execution without tying you to a framework. In Laravel you typically wire it into a controller or route, build resolvers through the service container, and wrap the StandardServer in middleware for auth and rate limiting. It also underpins higher-level packages like Lighthouse.
- How do I install webonyx/graphql-php with Composer?
- Run composer require webonyx/graphql-php in your Laravel project. The package has no framework dependencies, so there is nothing to register in config/app.php and no service provider is required. You point Composer at your project root and the library autoloads via PSR-4 like any other dependency.
- Which Laravel and PHP versions does graphql-php support?
- The library requires PHP 7.4 or newer, so modern Laravel releases on PHP 8.x work out of the box. Legacy applications pinned to older PHP runtimes will need an upgrade before installing it. Check the composer.json constraints of the version you install if you are maintaining an older Laravel LTS.
- Should I use webonyx/graphql-php directly or Lighthouse in Laravel?
- Lighthouse is built on top of webonyx/graphql-php and adds a schema-first, directive-driven layer that feels native to Laravel. Use Lighthouse if you want declarative SDL with directives and minimal boilerplate. Use graphql-php directly if you need tight control over execution, custom validation rules, or a code-first schema and are comfortable writing resolvers yourself.
- How do I build a schema with SDL or code-first definitions?
- You can parse schema definition language with BuildSchema::build or construct types programmatically using ObjectType, FieldDefinition, and the type system classes. Both approaches produce the same Schema instance that you pass to the executor. Many Laravel apps keep SDL files in resources and load them at boot, caching the parsed schema for production.
- How do I execute queries and return results in a Laravel controller?
- Parse the incoming query, validate it against the schema, then call GraphQL::executeQuery or use the StandardServer helper to handle the full request lifecycle. StandardServer parses the PSR-7 request, applies your validation rules and error formatter, and produces a JSON response. You can inject the schema and root value through Laravel's container for cleaner controllers.
- How does error handling and formatting work with Laravel's exception handler?
- Execution returns a result object with data and errors, and errors are FormattedError instances that you can reshape globally with a custom error formatter. That lets you hide internals in production while exposing debug details locally. You can also map domain exceptions to client-safe GraphQL errors before they reach App\Exceptions\Handler, keeping HTTP responses consistent.
- How can I limit query complexity or protect against expensive queries?
- The validation layer is extensible: add rules such as QueryComplexity or custom depth limits to the validation rule set you pass when executing. Rules run before execution, so abusive documents are rejected without touching resolvers or the database. Combined with Laravel middleware for auth and rate limiting, this covers most production hardening needs.
- Can I use persisted queries or caching with stripIgnoredCharacters?
- Yes. Printer::stripIgnoredCharacters removes characters that do not change a document's meaning, giving you a canonical document that hashes consistently for persisted queries and allow-listing. Call it once where the query is ingested, typically a thin controller or middleware, then use the hash as a cache or Redis key. No extra dependency or configuration is needed.
- Is webonyx/graphql-php actively maintained and safe for production?
- The project is mature, widely used, and receives regular releases, including input-hardening changes that reject invalid UTF-8 at parse time and batch error fixes that return RequestError instead of a TypeError. Sponsorship from its maintainer and OpenCollective backers funds ongoing work. Note the repository is planned to move to a new home, so follow the announcement discussion for future updates.
Weaver
How can I help you explore Laravel packages today?