The XAPlayer secure player in Laravel

Connect a Laravel site to XAPlayer: the key in .env, a controller using the Http client, a purchase check with Gate, and the player in Blade.

You’ll add a “watch course” route. The controller checks the user bought the course, gets a short-lived token from XAPlayer, and shows the player in a Blade view.

Before you start#

1. In your XAPlayer panel, open Settings and create an API key. It is shown only once, so copy it right away.
2. Under Websites allowed to show your player, add your site’s full address, such as https://academy.example.com. If your site also opens with www, add that too.
3. Get the course ID: in Settings, pick the course in “Show the player on your website” and the ID is filled into the sample code. It is also the last part of the course page’s address in the panel.
4. Give your Course model a column for the XAPlayer course ID; here it is xaplayer_course_id.

Configuration#

# .env
XAPLAYER_URL=https://en.xaplayer.ir/api/v1
XAPLAYER_API_KEY=xap_sk_...

Route and controller#

// routes/web.php
use App\Http\Controllers\LessonController;

Route::get('/courses/{course}/watch', [LessonController::class, 'show'])
    ->middleware('auth')
    ->name('courses.watch');

Test it#

1. Run php artisan config:clear so the new settings are read.
2. Open /courses/1/watch as a user who bought the course.
3. Open the same address as another user; you should get a 403.

If it doesn’t work#