Laravel websockets - Which PHP client ?

I have a central Identity Data Provider (IDP) which owns user information. Several client applications are syncing their local users from that IDP.

As IDP is the authority, I want it to broadcast messages (UserUpdated, UserDeleted, UserCreated...) to all the client applications about its users. But I do not want it to send X requests to the X client apps APIs.

That's why broadcasting messages through a websocket looks fine to me as a solution with each client app listening to it.

I made it work through public Pusher channels. But not through private channels as my PHP client does not seem able to authenticate to listen to private channels.

Hello, after looking inside of Laravel Echo JS Pusher client, I understand how "auth" is made when subscribing to private channels. This "authentication" logic is naturally not implemented in Textalk PHP client. So I have to do it by myself.

First step, to have Laravel broadcast events on a private channel, operate as below (example from a model):

public function broadcastOn($event)
{
    return new PrivateChannel('My.Private.Channel');
}

In routes/channel.php, declare your channel with a closure:

Broadcast::channel('My.Private.Channel', fn ($user) => true);

The closure will be evaluated only if you instantiate a PrivateChannel.

Then, the client needs to authenticate on /broadcasting/auth before subscribing to a private channel. You have to send a POST request to /broadcasting/auth with socket_id and channel_name :

Http::withHeaders([
    'Authorization' => 'Bearer ' . $personalAccessToken,
])->post(
    config('idp.url') . '/broadcasting/auth',
    [
        'socket_id' => $socketId,
        'channel_name' => $channel,
     ]
);

In the response, you get a auth token.

Add it to the subscribe message you send through websocket:

$this->client->text(json_encode([
    'event' => 'pusher:subscribe',
    'data'  => [
        'auth'    => $token, // Sanctum token
        'channel' => 'private-My.Private.Channel',
    ]
]));

Important note : Laravel automatically prefix your private channel name with "private-"

Last but not least, you can protect your /broadcasting/auth route with any middleware. For example, Sanctum:

public function boot(): void
{
    Broadcast::routes(['middleware' => ['auth:sanctum']]);
    include base_path('routes/channels.php');
}