The Laravel SDK Now Refreshes Flags Instantly, Not on a Timer

You flip a flag off in the dashboard because something's on fire, and then you wait. Not long — cache_ttl is probably set to a minute or two — but during an incident, a minute or two is exactly the amount of time you don't have. Every Laravel app using the SDK caches flag rules locally so evaluation stays fast, which means every one of them is also, by design, running on slightly stale data until the cache expires.

zenmanage-laravel 5.2.0 closes that gap. The package can now register a webhook endpoint that a Zenmanage environment webhook calls the moment a flag changes, and the handler refreshes the cache right then — no polling, no waiting for the TTL to lapse, and no integration code to write beyond turning it on.

Opt In, Not On By Default

The endpoint ships disabled. Turning it on is three steps:

1. Publish the config, if you haven't already: php artisan vendor:publish --tag=config.
2. Set ZENMANAGE_WEBHOOK_ENABLED=true and ZENMANAGE_WEBHOOK_SECRET in your .env.
3. In your Zenmanage dashboard, create an environment webhook pointing at https://your-app.com/zenmanage/webhook, and copy its signing secret (prefixed whsec_) into that same env var.

That's the whole integration. There's no controller to write and no listener to register — the package registers POST /zenmanage/webhook for you when webhook.enabled is true, and it stays entirely out of the way otherwise. If you'd rather not use the default path, webhook.path / ZENMANAGE_WEBHOOK_PATH lets you customize it.

Verified, Not Just Reachable

An endpoint that refreshes your app's flag cache on request is also an endpoint that anyone on the internet could hit, so it doesn't trust a request just because it arrived. Every call has to carry a valid X-Zenmanage-Signature header — the same HMAC-SHA256 signature Zenmanage already attaches to outbound webhook posts — checked against the secret you configured. No secret, no valid signature, no refresh: the controller rejects the request with a 401 before it touches anything.

One thing worth knowing if your app enforces CSRF verification globally: package routes registered this way aren't part of Laravel's web middleware group, so CSRF usually isn't a factor. If you've wired CSRF checks to apply everywhere regardless, exclude the webhook path explicitly — the README has the exact snippet for both Laravel 11+ and Laravel 10 and below.

Get Started

Update to zenmanage-laravel 5.2.0 or later and you already have it — it's just off until you flip the config flag above.

• Webhooks reference — how environment webhooks work, payload shapes, and delivery/retry behavior.
• Laravel quickstart — install and configure the SDK from scratch.
• Start your free trial — create an account and try it against a real environment.