Download the PHP package raqmeyat/webrtc without Composer

raqmeyat/webrtc

WebRTC signaling, call-session lifecycle and ICE/TURN credentials for Laravel 12 & 13 (PHP 8.4 & 8.5).

Laravel never touches media. This package does the server half of a call:

Install

Requirements: a broadcaster (php artisan install:broadcasting for Reverb), a cache store with atomic locks (Redis recommended), model:prune scheduled if you want old calls removed.

Map the models that can take part in calls in config/webrtc.php:

Keys must be strings (ULID/UUID, up to 36 chars). The alias (user, staff) is what clients send and what is stored.

Environment

coturn needs use-auth-secret, static-auth-secret=<secret> and a realm. Never ship the secret to clients; they only receive derived, expiring credentials.

HTTP API

Default prefix webrtc, middleware ['api', 'auth:sanctum'] (configurable via config/webrtc.php or WEBRTC_ROUTE_PREFIX). Mutating session routes require X-Idempotency-Key.

call_type: 1 audio, 2 video, 3 data. Session status: 1 ringing, 2 active, 3 ended, 4 declined, 5 missed, 6 cancelled.

Errors: { "errors": [{ "status": "409", "code": "participant_busy", "detail": "..." }] }.

Real-time events

Each participant subscribes to one private channel, webrtc.inbox.{participantId}, and receives:

• .webrtc.session → { event: ringing|accepted|declined|left|ended|cancelled|missed, actor, session }
• .webrtc.signal → { id, session_id, sender, target, type, payload, sent_at }

Authorize the channel through your normal /broadcasting/auth route (the package registers the channel callback; disable with webrtc.broadcasting.register_channels).

Client flow (browser)

Rules the server enforces: a callee must accept (HTTP) before it can send answer/candidate; signals only flow while the session is ringing/active; only whitelisted payload keys are relayed.

Extending

Who may call whom - implement Raqmeyat\WebRtc\Contracts\InvitationPolicy and set webrtc.invitation_policy:

Push notifications - listen to SessionStateChanged and send FCM/APNs when $event->event === SessionEvent::Ringing. The event fires after the DB commit.

Another ICE provider (Twilio, Cloudflare...):

Custom Models & Database Connection: You can swap the session and participant models or point them to a dedicated database connection via config/webrtc.php:

Architecture: Actions, DTOs, Services & Enums

The package adheres to strict layering: FormRequest → DTO → Action → Service → Model.

Actions

Single-purpose, invocable action classes that authorize operations and orchestrate business logic:

Example: Invoking Actions from your own code

Operations

• webrtc:expire runs every minute (scheduler, onOneServer) and marks unanswered calls missed. Disable with webrtc.sessions.schedule_expiry.
• Schedule model:prune to delete finished sessions after webrtc.sessions.retention_days.
• The migrations only add two tables, safe for rolling deploys.
• Busy-checks use cache locks; with several app servers use Redis, not file/array.
• Group calls are a mesh (every pair negotiates). Keep max_participants at 4 or lower; use an SFU (LiveKit, mediasoup) beyond that.

Testing

License

The MIT License (MIT). Please see LICENSE for more information.