Laravel API Key Alert

Get an email the moment an API key stops working in your Laravel app, and again when it works. The package notices the rejected key in the calls your app already makes, so a revoked OpenAI key or a Google key restricted to the wrong IP address no longer waits for a customer to complain.

It also watches your environment: turn on the environment check and you get a reminder every day that APP_DEBUG is still on or APP_ENV is still local on a server where it should not be, until you fix it.

Features

• No code changes - Http client calls and reported exceptions are inspected for Google, OpenAI, Anthropic, Mollie and MessageBird
• Google Maps aware - reads the HTTP 200 REQUEST_DENIED answer that a status code check misses
• One mail, not a hundred - at most one per service per six hours, plus one when the key works again
• Four routes, each optional - passive detection, reported exceptions, ApiKeyAlert::guard() around a call, and a daily check
• Environment check - a daily reminder while APP_DEBUG or APP_ENV has a value it should not have on that server, and a mail when it is fixed
• Two commands - api-key-alert:status shows which keys are down (also as JSON), api-key-alert:test sends a test mail
• Never in the way - the mail goes out after the response; a broken mailer never breaks a page
• Keys stay out of the mail - secret parameters, bearer tokens and known key formats are removed
• Events - ApiKeyFailed and ApiKeyRecovered, for Slack or a dashboard
• Laravel Boost - guideline and skill included, so an AI assistant in your app knows the API

Requirements

• PHP 8.2 or higher
• Laravel 11, 12 or 13 (Laravel 13 itself needs PHP 8.3)
• A working mailer

Installation

composer require darvis/laravel-api-key-alert

API_KEY_ALERT_MAIL_TO=you@example.com

That is all for the services the package ships. Send a test alert, and see which keys are down:

php artisan api-key-alert:test
php artisan api-key-alert:status

Quick start

Calls through Http:: need nothing. For an SDK call whose exception you catch yourself, wrap it:

use Darvis\LaravelApiKeyAlert\Facades\ApiKeyAlert;

$payment = ApiKeyAlert::guard('mollie', fn () => $mollie->payments->get($id));

The guard reports a rejected key and throws the exception again, so your own try/catch still runs.

Add an API the package does not know in config/api-key-alert.php:

'services' => [
    'postnl' => [
        'hosts' => ['api.postnl.nl'],
    ],
],

Find a dead key before anyone uses it, and get reminded while the server runs with APP_DEBUG=true or an APP_ENV other than production:

API_KEY_ALERT_CHECK=true
API_KEY_ALERT_ENVIRONMENT_CHECK=true

Both run once a day through the scheduler. The expected values live in the config, so they are yours to change.

Documentation

Full documentation: https://arviddejong.github.io/laravel-api-key-alert/

• Installation
• How detection works
• Configuration
• Adding a service
• Daily check
• Environment check
• Commands
• Recipes
• Testing
• Troubleshooting
• FAQ

Laravel Boost

The package ships a Laravel Boost guideline and skill. Boost only loads them for packages listed in your app's boost.json: add "darvis/laravel-api-key-alert" to its packages list, then run php artisan boost:install --guidelines --skills --mcp --no-interaction. A plain boost:update does not pick up a new package.

Testing

composer test
composer lint
composer analyse

Changelog

See CHANGELOG.

Support the package

If darvis/laravel-api-key-alert saves you time, buy me a beer 🍺: sponsor me on GitHub.

Contributing

See CONTRIBUTING.

Security

Please report a vulnerability privately, as described in SECURITY, not in the issue tracker.

License

The MIT License (MIT). See LICENSE.