Download the PHP package serfix/content-ai-laravel without Composer

Serfix Content AI for Laravel

Receive articles published by Serfix Content Autopilot into your Laravel app, store them, and serve them at a URL you choose — with SEO metas, BlogPosting schema and self-hosted images.

This is the Laravel counterpart to the WordPress plugin. Serfix pushes each article to a signed webhook; this package verifies, imports and renders it.

Production: if your box runs opcache.validate_timestamps=0 (typical for PHP-FPM in production), restart the SAPI — sudo systemctl restart php8.3-fpm — or the new package code and config are never re-read, and the install looks like it did nothing.

content-ai:install prints a generated signing secret. Put it in .env:

Then in Content Autopilot → Connect publishing, pick the Laravel tab and enter:

Confirm the plumbing without waiting for a real publish:

The blog URL

/{prefix}/{slug} — set the prefix and you're done:

Everything the package generates follows it: article URLs, breadcrumbs, the sitemap, and cross-article links inside the HTML. Registered routes:

Rendering articles inside your own app instead? Set CONTENT_AI_ROUTES_ENABLED=false — the webhook keeps receiving, and you query the model yourself:

Keep your own design

Three globals are available in every Blade view. Drop them into your existing layout and build whatever you like around them:

Same thing as directives or helpers, whichever suits your codebase:

They render to an empty string on any page that isn't showing an article, so they're safe in a layout shared by your whole site — nothing is computed until echoed.

Rendering articles from your own controller? Tell the package which one is current and the globals work there too:

content-ai.render.schema_in moves the JSON-LD to body_below if you prefer it at the end of the document; content-ai.render.related sets how many related links to show (0 to omit). render.globals => false stops sharing the variables entirely — the helpers keep working.

SEO

The globals already include everything below; these components exist for finer control.

meta emits title, description, canonical, robots, Open Graph and Twitter card. schema emits BlogPosting + BreadcrumbList JSON-LD — plus an FAQPage node lifted from the FAQ block Content AI already writes, which is rich-result eligible at no extra authoring cost.

Using your own SEO package? Take the array instead:

Drafts and unpublished articles are automatically noindex, nofollow.

Images are copied to your disk

Articles arrive with <img> pointing at Serfix storage. Every one is downloaded, stored on your disk and the src rewritten — published pages never hotlink someone else's bucket, and they keep working if the original is moved or expired.

A download that fails leaves the original src in place, so a flaky fetch degrades to a hotlinked image rather than a broken one. Only https hosts on config('content-ai.images.allowed_hosts') are ever fetched — that allow-list is an SSRF guard, so widen it deliberately.

Drafts and review

Every delivery is parked as a draft. Drafts 404 publicly and open only through a signed, expiring preview link:

Set CONTENT_AI_PRESERVE_LOCAL_EDITS=true and a row you edited by hand will not be overwritten by a later article.updated delivery.

Events

Hook these to purge a CDN, reindex a search engine, or notify a channel.

Customising

Point content-ai.views.layout at your own layout, or swap the model/controller entirely via content-ai.models.* and your own routes.

The wire format

POST with X-Serfix-Signature: sha256=<hmac_sha256(raw_body, secret)>.

We answer {"ok":true,"id":"…","url":"…","status":"published"}. The url matters: Serfix stores it as the published location, so without it there is no record of where your article actually went.

Security

• Sanitised by default. Article HTML is run through an allow-list sanitizer before it is stored — no <script>, no on* handlers, no javascript:/data: URLs, no <iframe>/<form>/style=. The signature is the only barrier between an attacker and markup on your page, so a leaked signing secret must not become stored XSS. Dependency-free (DOMDocument). Disable with CONTENT_AI_SANITIZE_HTML=false only if you fully trust the publisher.
• https only. Serfix refuses to send to an http:// endpoint: the HMAC stops forgery, not eavesdropping.
• Strong secrets. Serfix generates a 48-character secret for you; anything under 32 characters is rejected. Never reuse one across sites — one secret is one site's entire identity.

Three properties this receiver guarantees:

• Authenticity — HMAC over the raw body (re-encoding JSON does not round-trip byte-for-byte), compared with hash_equals, plus a timestamp window so a captured request cannot be replayed later.
• Idempotency — Serfix retries on any non-2xx. A repeat delivery matches on external_id, then on slug, and updates instead of creating. A lost 200 can never duplicate a post.
• Honest failures — a broken payload answers 4xx/5xx so the publisher retries, rather than a cheerful 200 that silently drops the article.

Testing

Requirements

PHP 8.2+ · Laravel 11 or 12

License

MIT