Download the PHP package codearachnid/check-commerce-laravel-sdk without Composer

Laravel integration for the Check Commerce (OBP Link) API — ACH, RTP, paper check and IAT payments, stored consumers, recurring subscriptions, hosted payment pages, batch processing and merchant boarding.

Everything that talks to the API lives in codearachnid/check-commerce-php-sdk. This package is the Laravel half of it:

• Configured like the rest of your app — a publishable config file mapping CHECK_COMMERCE_* environment variables onto every SDK option.
• Resolved from the container — CheckCommerceClient is a singleton you can inject, plus a CheckCommerce facade.
• Tokens shared across processes — bearer tokens live in Laravel's cache and expire with the token itself, so workers stop re-authenticating one at a time.
• Transport you can replace — bind your own PSR-18 client and PSR-17 factories and the SDK uses them.
• Testable without HTTP mocks — CheckCommerce::fake() queues responses and records requests in feature tests.

Requirements

• PHP 8.3+
• Laravel 12 or 13
• A PSR-18 HTTP client and PSR-17 factories (Guzzle is recommended and auto-discovered)

Installation

The core SDK is pulled in as a dependency; you never install it separately. Omit guzzlehttp/guzzle if your application already ships a PSR-18 client — the SDK discovers whatever implementation is installed.

Publish the config file:

Then add your credentials:

Every key in config/check-commerce.php is documented in place, including scopes, retry backoff and the HTTP client toggle.

Usage

Inject the client anywhere the container builds your class:

Or reach for the facade:

The facade exposes the SDK's services as methods — transactions(), consumers(), subscriptions(), batches(), hostedPages(), boarding() — plus authenticate(). Injected clients read them as properties ($client->transactions); both return the same objects.

Credentials are validated the first time the client is resolved, not during boot, so an application missing CHECK_COMMERCE_API_KEY still runs its migrations and queue workers.

Transactions

Consumers

Subscriptions

Hosted payment pages

Batches

Merchant boarding

Errors

Every API failure is a typed exception from the core SDK — ValidationException, AuthenticationException, AuthorizationException, NotFoundException, RateLimitException, ServerException, ApiException and TransportException, all implementing CheckCommerce\Exception\CheckCommerceException:

Token caching

The SDK requests a bearer token on the first API call and refreshes it before expiry. This package stores that token in Laravel's cache instead of in process memory, and the cache entry expires exactly when the token does.

That matters as soon as your application runs more than one PHP process — web workers, queue workers, scheduled commands. With per-process storage each of them authenticates separately, and keeps re-authenticating after every deploy or worker restart. With a shared store they issue one token between them.

Use redis, memcached or database in production. The file store works on a single server; array is per-request and effectively disables sharing. The cache key is derived from your base URL, merchant number, API key and scopes, so multiple merchants in one application never collide.

Warm the token at deploy time — and fail loudly on bad credentials — with:

Testing

CheckCommerce::fake() swaps the transport for a recording PSR-18 client. Everything else — your config, the container binding, the token store — stays exactly as it is in production:

• Responses are replayed in the order they are queued; queue() also accepts a Throwable to simulate a transport failure.
• Queue a non-2xx response to exercise your error handling — the SDK still maps it to its typed exception.
• The fake answers the SDK's authentication call itself, so the queue and the recorded requests only ever hold the calls your application made. Call withoutAuthentication() when the authentication request is what you are testing.
• Credentials are stubbed when your testing environment has none, so phpunit.xml needs no Check Commerce variables.
• Assertions: assertSent(), assertNotSent(), assertSentCount(), assertNothingSent(). Raw requests are on $checkCommerce->requests, with lastRequest() and requestCount() as shortcuts.

Replacing the HTTP client

Bind a PSR-18 client (or PSR-17 factories) in the container and the SDK uses it — handy for proxies, logging middleware or a shared connection pool:

Set check-commerce.http_client.from_container to false to ignore container bindings and let the SDK discover and build its own client.

Contributing

The package develops against Orchestra Testbench. composer serve boots a throwaway Laravel application from workbench/ with the package already registered, which is the quickest way to try a change against a real app.

See our contributing guide to get started.

Changelog

Please see CHANGELOG for more information on what has changed recently.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Timothy Wood
• All Contributors

License

Check Commerce for Laravel is open-sourced software licensed under the MIT license.