README

Surface Stripe API requests — those made by Laravel Cashier and the Stripe PHP SDK — on your Laravel Nightwatch timelines, with the request URL redacted by default.

Stripe's PHP SDK uses its own cURL client, so its API calls bypass Nightwatch's Guzzle instrumentation and never show up on your timelines. This package swaps in a Nightwatch-aware cURL client so they do.

Installation

composer require clarkewing/cashier-nightwatch

The service provider is auto-discovered. To customise redaction, publish the config:

php artisan vendor:publish --tag=cashier-nightwatch-config

What is recorded — and redacted

Nightwatch stores only the method, URL, byte sizes and status code for an outgoing request — never request/response headers or bodies. Consequently:

• Your Stripe secret key (the Authorization header) is never captured.
• Request/response bodies (card data, customer PII on writes) are never captured — only their byte size.
• The URL is the only sensitive surface, because Stripe list/search calls put filters such as email or customer in the query string.

By default the package redacts query-string values while keeping the keys:

GET https://api.stripe.com/v1/customers?email=REDACTED&limit=REDACTED

Configuration

Each maps to an env var: CASHIER_NIGHTWATCH_ENABLED, CASHIER_NIGHTWATCH_REDACT_QUERY, CASHIER_NIGHTWATCH_MASK_PATH_IDS.

For full control you can also use Nightwatch's own hook in a service provider (the record's url is mutable):

use Laravel\Nightwatch\Facades\Nightwatch;

Nightwatch::redactOutgoingRequests(function ($record) {
    $record->url = '...';
});

Compatibility

This integrates at the Stripe SDK level (Stripe\ApiRequestor::setHttpClient) and relies on a few Laravel Nightwatch internals (Core::$clock, Core::$config, outgoingRequest(), paused()). It targets Nightwatch 1.x and may need updating across a Nightwatch major version.

Streaming Stripe responses (requestStream) are not instrumented.

Testing

composer install
composer test

License

MIT — see LICENSE.