Download the PHP package usamamuneerchaudhary/laraclient without Composer

LaraClient

Configure every third-party API your Laravel app talks to in one file, then see every call in one dashboard.

Ten APIs, ten credential schemes, ten sets of rate limits, declared once in config/lara_client.php instead of scattered across ten service classes. Retries, throttling, caching, circuit breaking and redacted request logging come with it.

Requirements

Running Laravel 10–12? Stay on LaraClient 1.x, or see UPGRADE.md.

Installation

The service provider and LaraClient alias are registered automatically, no app.php edit needed.

Configuring connections

Each connection declares only what makes it different; everything else falls back to the defaults block.

Authentication drivers

OAuth2 tokens are fetched on first use, cached until shortly before expiry, and re-fetched automatically on a 401. None of that appears in your application code.

Signing schemes of your own (HMAC, JWT assertions, mTLS headers) plug in without forking:

Making requests

Everything is fluent, and every method returns a clone, so a shared base request never leaks one caller's settings into another's.

Responses

json() decodes once and reuses the result, and isJson() tells you whether the body actually parsed, which is how you catch an HTML error page served with a 200.

Resilience

Retries

Exponential backoff with full jitter, bounded attempts, and Retry-After honoured in both integer and HTTP-date form.

Unsafe verbs are not retried by default, replaying a POST can charge a customer twice. Opt in with retryUnsafeMethods(), ideally alongside idempotent().

Rate limiting

Throttling is scoped per connection and throws instead of sleeping, so a queued job can hand the work back to the queue rather than parking a worker:

Set 'on_limit' => 'wait' if blocking is genuinely what you want.

Circuit breaker

After N consecutive server errors the circuit opens and requests fail fast with CircuitOpenException instead of piling load onto an upstream that is already down. Once the cooldown elapses, the next request goes through as a probe: success closes the circuit, failure restarts the cooldown.

CircuitOpened and CircuitClosed events fire on each transition.

Caching

GET and HEAD only. Cache-Control: max-age from the provider wins when it is shorter than your TTL, no-store and private are respected, and entries with an ETag are revalidated with a conditional request when they go stale, a 304 costs one round trip and no payload.

On a tagged cache store you can flush one integration without touching the rest of the app:

Concurrency

Every request in a pool shares one curl multi handler, so they genuinely run in parallel.

A failed request appears in place as its exception rather than taking the batch down with it.

Pagination

Declare the strategy once per connection, then stop thinking about it:

Backed by a LazyCollection, so memory stays flat across three pages or three thousand. Strategies: page, offset, cursor and link_header (RFC 8288). Use ->chunks() to yield whole pages for batch inserts, and ->maxPages() as a safety valve on endpoints that never stop.

Testing

Patterns match either the full URL or the connection/path shorthand. An unmatched request returns an empty 200 rather than reaching the network, a fake that silently makes real calls is worse than no fake at all.

Pass a list to script a sequence, which is how you test retry paths:

LaraClient::failedConnection() simulates a transport failure for exercising backoff and circuit breaker behaviour.

Record and replay

Hand-written fixtures drift from the API they describe. Record the real thing once, replay it forever:

Fixtures pass through the same redactor as the logs, so recording against a live account does not commit your API keys.

Observability

The dashboard

/laraclient/logs, every outbound call, filterable by connection, endpoint and failure, with a latency trace strip across the top: one bar per call, height is latency, colour is outcome. A cluster of red bars is a failing window; a wall of tall bars is a slow upstream.

The dashboard is gated. It shows request and response bodies, so define who may see it:

Without a definition it denies everyone outside local. Auth middleware is optional, add it to dashboard.middleware when you want Laravel to require a logged-in user first:

Events

Plus global hooks, mirroring the shape Laravel 13 gave its own HTTP client:

Pulse

If laravel/pulse is installed, per-connection latency and error counts are recorded automatically. Cache hits are excluded, counting them would flatter the numbers.

Artisan commands

Generating a typed client

laraclient:make turns an OpenAPI 3 document into a plain, readable PHP class you own:

Path parameters become typed, ordered arguments; operationId collisions are de-duplicated; deprecated operations are annotated. The fluent API stays reachable through using():

It generates methods and parameters, not typed response DTOs, that is on the roadmap for 2.1.

Security

Everything written to the logs table or a fixture passes through the redactor first: credential headers, sensitive body keys (recursively, including inside lists) and secrets carried in query strings. Widen the mask for your own field names:

If you are upgrading from 1.x, read UPGRADE.md before deploying, v1 stored credentials in the logs table in plaintext, and there are steps to take beyond installing this release.

To report a vulnerability, email [email protected] rather than opening an issue.

Testing the package

Credits

• Usama Muneer
• All Contributors

License

MIT. See LICENSE.md.