### Install laravel-webhook-signatures via Composer

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Install the package via Composer. Requires PHP 8.2+ and Laravel 11.x+.

```bash
composer require jeffersongoncalves/laravel-webhook-signatures
```

--------------------------------

### Run package tests, analysis, and formatting

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Run the package's test suite, static analysis, and code style checks. The commands use Pest, PHPStan (level 5 with Larastan), and Laravel Pint respectively.

```bash
composer test       # Pest
composer analyse    # PHPStan (level 5, Larastan)
composer format     # Laravel Pint
```

--------------------------------

### Publish webhook-signatures config

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Publish the configuration file (optional).

```bash
php artisan vendor:publish --tag="webhook-signatures-config"
```

--------------------------------

### Verify webhook signature via WebhookSignatures facade

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Uses the WebhookSignatures facade to verify a Sendgrid webhook request. If verification fails, the request is aborted with a 403 status. The secret is read from the configuration unless explicitly passed.

```php
use JeffersonGoncalves\WebhookSignatures\Facades\WebhookSignatures;

public function handle(Request $request)
{
    if (! WebhookSignatures::verify('sendgrid', $request)) {
        abort(403);
    }

    // ... process the event
}
```

--------------------------------

### Set timestamp tolerance in config/webhook-signatures.php

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Configure timestamp tolerance in seconds. Default is 300 seconds for Mailgun, Resend, and SendGrid; SNS uses 3600 seconds because it may redeliver messages later.

```php
// config/webhook-signatures.php
'tolerance' => [
    'default' => 300,   // Mailgun, Resend, SendGrid
    'sns'     => 3600,  // SNS may redeliver messages later
],
```

--------------------------------

### Register webhook.signature middleware for Mailgun and Resend

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Registers the 'webhook.signature' middleware alias for Mailgun and Resend providers. The middleware aborts with a 403 response when the signature cannot be verified. The secret is read automatically from config('webhook-signatures.providers.{provider}.secret').

```php
use Illuminate\Support\Facades\Route;

Route::post('/webhooks/mailgun', InboundController::class)
    ->middleware('webhook.signature:mailgun');

Route::post('/webhooks/resend', ResendController::class)
    ->middleware('webhook.signature:resend');
```

--------------------------------

### Configure webhook secrets in .env

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Define provider-specific secrets in your .env file. The meaning of the secret varies per provider.

```dotenv
WEBHOOK_MAILGUN_SIGNING_KEY=...           # Mailgun signing key
WEBHOOK_SENDGRID_VERIFICATION_KEY=...     # SendGrid ECDSA verification key
WEBHOOK_POSTMARK_BASIC_AUTH=user:password # Postmark Basic Auth credentials
WEBHOOK_RESEND_SECRET=whsec_...           # Resend Svix secret
WEBHOOK_SNS_TOPIC_ARN=arn:aws:sns:...     # expected TopicArn (SES via SNS)
GITHUB_WEBHOOK_SECRET=...                  # GitHub webhook secret (HMAC-SHA256)
```

--------------------------------

### Use standalone ResendSignatureVerifier

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Instantiates a standalone ResendSignatureVerifier with a tolerance of 300 seconds and verifies a request. The verify method returns a boolean indicating whether the signature is valid.

```php
use JeffersonGoncalves\WebhookSignatures\Verifiers\ResendSignatureVerifier;

$verifier = new ResendSignatureVerifier(tolerance: 300);

$valid = $verifier->verify($request, $secret); // bool
```

--------------------------------

### Register custom verifier with WebhookSignatures::extend

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Registers a custom verifier for the 'my-provider' provider. The custom verifier must implement the SignatureVerifier contract and accept an int $tolerance in its constructor.

```php
use JeffersonGoncalves\WebhookSignatures\Facades\WebhookSignatures;

WebhookSignatures::extend('my-provider', MyVerifier::class);
```

--------------------------------

### Verify webhook signature with explicit secret

Source: https://github.com/jeffersongoncalves/laravel-webhook-signatures/blob/main/README.md

Passes the secret explicitly to the WebhookSignatures facade, bypassing the configuration. This is useful when the secret is not stored in the config file.

```php
WebhookSignatures::verify('mailgun', $request, $myKey);
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.