Frequently asked questions
What does darvis/laravel-api-key-alert do?
It mails you when an API key of your Laravel app stops working: revoked, expired, restricted to the wrong IP address, or out of credit. It finds out from the calls your app already makes, so you hear about it before a customer or a colleague does, and it mails once more when the key works again.
Do I have to change my code to use it?
No. After installing, set API_KEY_ALERT_MAIL_TO. Calls through the Laravel Http client and reported exceptions are inspected automatically for Google, OpenAI, Anthropic, Mollie and MessageBird. You only add code for an SDK whose errors never reach report(); wrap that call in ApiKeyAlert::guard().
Why does a Google Maps key failure not show up as an error?
Google Maps web services (Geocoding, Directions, Places) answer a rejected key with HTTP 200 and the status REQUEST_DENIED in the body. A check on the status code never sees it. The package ships a GoogleDetector that reads the body, and its message names the IP address the request came from, which is what you add to the key restrictions.
How many mails will I get when a key breaks?
One per service per throttle window, six hours by default, however many requests fail in that time. A recovery mail follows once the key works again, and that resets the window, so a key that breaks a second time is reported straight away.
Does the alert mail contain my API key?
No. Keys are removed from URLs, messages and context before anything is mailed, logged or passed to an event: secret query parameters such as key and token, bearer tokens, and the key formats of Google, OpenAI, Anthropic and Mollie.
Does it make extra API calls?
Only if you turn on the daily check (API_KEY_ALERT_CHECK=true). That sends one cheap request per service a day, such as one geocode for Google. Passive detection reads the responses your app already receives and costs nothing.
Can it slow down my pages?
The listener only looks at responses from hosts of a configured service, and only decodes a body when the status or a quick string check calls for it. The mail is sent after the response has gone to the visitor, or through the queue when API_KEY_ALERT_MAIL_QUEUE is true.
How do I add an API the package does not know?
Add a service with its hosts to config/api-key-alert.php. HTTP 401 and 403 are then reported. If the API signals a rejected key differently, write a class that implements the Detector interface and set it as the service’s detector.
My API key has a different environment variable. What do I change?
Nothing for passive detection, which looks at the responses and not at the key. For the daily check, point the check at the config key your app already uses, in the boot() method of AppServiceProvider, for example config([‘api-key-alert.services.google.check.query.key’ => ‘config:services.google.key_php’]). There is no need to publish the config or to repeat the key in .env.
Can it warn me when APP_DEBUG is still on in production?
Yes. Set API_KEY_ALERT_ENVIRONMENT_CHECK=true in the .env of that server. Once a day the package compares app.debug and app.env with the expected values from the config (false and production by default) and mails you every day they are wrong, plus once more when they are right again. Any config key can be added to the list.
How do I see which keys are down right now?
Run php artisan api-key-alert:status. It reads the cache, so it costs no API calls, and it exits with a failure when a key is down. Add –json for a dashboard or a monitoring tool. In code, ApiKeyAlert::failure(‘google’) gives the reason and the time it was first rejected.
How do I know the mail works at all?
Run php artisan api-key-alert:test. It sends a test alert and a test recovery mail to the configured address straight away, without the cache, the throttle or the queue, so nothing is left behind.
Can I get the alert in Slack instead of by mail?
Listen to the ApiKeyFailed and ApiKeyRecovered events and send it wherever you like. Leave API_KEY_ALERT_MAIL_TO empty if you don’t want the mail.
How do I test code that uses it?
Use Mail::fake() and Http::fake() as usual. A faked Http response goes through the same listener as a real one, so a fake 401 from api.openai.com sends the alert mail. Assert on ApiKeyFailedMail, or fake the ApiKeyFailed event.