Webhooks with Laravel

example.env

XERO_CONSUMER_KEY=YOUR-APP-KEY
XERO_CONSUMER_SECRET=YOUR-SECRET-KEY
XERO_RSA_PRIVATE_KEY='file:///home/vagrant/code/test-web-app/storage/privatekey.pem'
XERO_RSA_PUBLIC_KEY='file:///home/vagrant/code/test-web-app/storage/publickey.cer'
XERO_WEBHOOK_KEY=YOUR-WEBHOOK-KEY

Kernel.php

<?php

namespace App\Http;
class Kernel extends HttpKernel
{
	/** More code above */

    protected $routeMiddleware = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password_expires' => \App\Http\Middleware\PasswordExpires::class,
        'permission' => \Spatie\Permission\Middlewares\PermissionMiddleware::class,
        'role' => \Spatie\Permission\Middlewares\RoleMiddleware::class,
        'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
        'verify_xero' => \App\Http\Middleware\VerifyXeroToken::class,
    ];
  	/** More code below */
}

VerifyXeroToken.php

<?php

namespace App\Http\Middleware;

use Closure;
use XeroPHP\Webhook;
use XeroPHP\Application\PrivateApplication;

/**
 * Class VerifyXeroToken.
 */
class VerifyXeroToken
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string|null  $guard
     * @return mixed
     */
    public function handle($request, Closure $next, $guard = null)
    {
        $application = new PrivateApplication(config('xero'));
        $webhook = new Webhook($application, $request->getContent());

        if (! $webhook->validate($request->headers->get('x-xero-signature'))) {
            $response = response()->json(null, 401);
            $response->setContent(null);

            return $response;
        }

        return $next($request);
    }
}

webhooks.php

<?php

Route::group(['namespace' => 'Api\v1\Webhooks', 'prefix' => 'webhooks', 'as' => 'webhooks.'], function () {
    //
    Route::post('acuity', 'AcuitySchedulingWebhookController@handle');
    Route::post('xero', 'XeroWebhookController@handle')->middleware('verify_xero');
});

XeroWebhookController.php

<?php

namespace App\Http\Controllers\Api\v1\Webhooks;

use XeroPHP\Webhook;
use App\Models\Invoice;
use Illuminate\Http\Request;
use App\Jobs\Xero\SyncXeroInvoice;
use App\Http\Controllers\Controller;
use XeroPHP\Application\PrivateApplication;
use App\Repositories\Backend\InvoiceRepository;

class XeroWebhookController extends Controller
{

    public function handle(Request $request)
    {
        $webhook = new Webhook(new PrivateApplication(config('xero')), $request->getContent());

        foreach ($webhook->getEvents() as $event) {
            $invoice = Invoice::whereXeroGuid($event->getResourceId())->first();
            if ($invoice) {
                dispatch_now(new SyncXeroInvoice($this->invoiceRepository, $invoice));
            }
        }

        $response = response()->json(null, 200);
        $response->setContent(null);

        return $response;
    }
}