Laravel Cloud

Connect your Laravel Cloud organization to Ciphrix using a scoped organization API token for automated compliance monitoring of your applications, environments, and cloud resource configuration.

Capabilities

The Laravel Cloud integration provides the following capabilities:

✅ Compliance Checks

Automatically review security configuration and deployment metadata across your Laravel Cloud resources including:

• Object storage bucket private visibility
• Cache public access settings
• Restricted WebSocket application origins
• Custom domain TLS and hostname verification
• HTTP Strict Transport Security (HSTS) with a maximum age of at least one year
• Edge firewall protection for sensitive paths such as .env and .git
• A positive edge rate-limit threshold and a configured enforcing action
• Clickjacking protection using DENY or SAMEORIGIN
• MIME sniffing protection using nosniff
• Database backup retention greater than zero
• Upstream security support for the currently deployed PHP runtime
• Source commit and branch information on successful deployments

These checks review the configuration and records reported by Laravel Cloud. They do not independently test traffic blocking, restore backups, or establish that a deployed change was approved. Linked checks support your compliance review; they do not automatically complete the corresponding tests.

🔄 Import Asset

Import and track Laravel Cloud organizations, applications, environments, object storage buckets, caches, database clusters, WebSocket clusters and applications, and custom domains as assets in your Ciphrix inventory.

Asset import is disabled by default. Select Laravel Cloud Assets when creating the connection, or enable it later from the connection details. Deployment records are used for compliance checks, not imported as assets.

How to Connect Laravel Cloud

Prerequisites

Before connecting Laravel Cloud, ensure you have:

• A Laravel Cloud organization with access to the applications, environments, and resources you want to monitor
• Permission to create an API token in that organization's settings
• The six read permissions listed below on the token
• Access to the plan-dependent features you want to assess

Basic edge rate limiting is available on Laravel Cloud's Growth and Business plans. Advanced rate limiting is available on Business. Ciphrix reads the reported configuration; a positive configuration result does not independently confirm your plan entitlement or that requests were blocked.

Important API Token Notes

Ciphrix uses the Laravel Cloud API for this integration.

• This integration is for Laravel Cloud, not a direct connection to a self-hosted Laravel application.
• Create an organization API token in Laravel Cloud. Do not use a Laravel Sanctum token, application secret, database password, or object storage access key.
• The token's permissions and resource scope are separate settings. Allow the required read actions without granting full access to every action.
• An API token does not inherit the permissions of the user who creates it. Select its permissions and resource scope explicitly.
• Ciphrix scans the supported resources and all environments the token can read, including non-production environments when they are in scope.
• Ciphrix does not select production environments based on their names or the application's default environment.
• The Connection Identifier and Credential Name are labels in Ciphrix. They do not filter which applications or environments are scanned.
• To limit coverage, use Laravel Cloud's application/environment resource scoping, not the Ciphrix connection identifier.

Select individual read permissions, not entire groups

Laravel Cloud's permission-group checkboxes can select create, edit, and delete actions as well as view access. Expand the groups and select only the six permissions below. Full-access tokens and write permissions are not requested for this integration.

Connection Instructions

Step 1: Create a Laravel Cloud Organization API Token

1. Log in to Laravel Cloud

   • Go to Laravel Cloud sign-in
   • Sign in and select the organization that owns the resources you want Ciphrix to monitor

2. Open API Token Settings

   • Open your organization's settings
   • Select API tokens
   • Click Create API Token

3. Configure the Token

   • Enter a descriptive name such as Ciphrix Compliance Monitoring
   • Choose an expiration period
   • Select only these individual permissions:
     • application.view
     • environment.view
     • database_cluster.view
     • cache.view
     • filesystem.view
     • websocket_cluster.view
   • Do not select entire permission groups or add create, edit, delete, deployment, or credential-view permissions

4. Choose Resource Access

   • Allow access to all applications and environments you want Ciphrix to monitor
   • For coverage across the organization, allow all applications and environments rather than selecting a subset
   • Resource access does not require granting all permission actions
   • Review the selections and click Create

5. Copy and Store the Token Securely

   • Copy the token value immediately
   • Laravel Cloud only shows the token value once
   • Store it securely until you add it to Ciphrix
   • Paste it only into the Access Token field, not into connection names or identifiers

Step 2: Initiate Laravel Cloud Connection in Ciphrix

You have two options to initiate the Laravel Cloud connection:

Option A: From Integration Library (Recommended)

1. Navigate to Integration Library

   • Log in to ciphrix.app
   • Go to Integrations in the sidebar
   • Go to the Integration Library tab
   • Browse to Cloud Infrastructure and find Laravel Cloud

2. Connect Laravel Cloud

   • Click the Connect button on the Laravel Cloud integration tile
   • A connection form will appear

Option B: From Create Connection

1. Navigate to Create Connection

   • Log in to ciphrix.app
   • Go to Integrations in the sidebar
   • Click Create Connection

2. Select Laravel Cloud

   • From the connection provider dropdown, select Laravel Cloud
   • A connection form will appear

Step 3: Fill Connection Details

1. Enter Connection Information

   • Connection Name: Enter a friendly name for this connection
     • Example: "Engineering Laravel Cloud"
     • Example: "Company Cloud Applications"
   • Connection Identifier: Enter a clear label for this Laravel Cloud connection
     • Example: engineering-laravel-cloud
     • This label does not limit which resources or environments are scanned
   • Credential Name: Enter a name to identify the saved credential
     • Example: "Ciphrix Laravel Cloud Token"
   • Access Token: Paste the organization API token created in Step 1
   • Select Items: Keep Laravel Cloud Checks selected. Select Laravel Cloud Assets if you want to import asset information; it is off by default

2. Create Connection

   • Click Create Connection
   • Wait for the credentials to be saved and the connection to be created

Step 4: Verify Connection

1. Check Connection Status

   • Open the new connection in Integrations
   • Status should show Active after the credentials are saved
   • Check setup happens in the background; creating a connection does not itself start a scan
   • A successful scan confirms provider access for the resources it reads. Review individual check results for permission or collection errors as well

2. Initial Scan

   • Ciphrix scans your environment once a week on its scheduled scan day
   • The first scheduled scan discovers supported resources visible to the token and runs the compliance checks
   • You can contact support@ciphrix.com to know your next scan date

3. View Results

   • Navigate to Monitoring
   • Filter by Laravel Cloud to view check results and findings
   • If asset import is enabled, navigate to Assets to view imported Laravel Cloud resources

Permissions and Data Access

Select the following individual permissions when creating the organization API token. These are the permission codes shown in Laravel Cloud, not API endpoint names:

Permission	Required For
application.view	Discover applications and their environments
environment.view	Read environment configuration, custom domain status, and deployment metadata
database_cluster.view	Read database cluster configuration and backup retention
cache.view	Read cache configuration and public access settings
filesystem.view	Read object storage bucket metadata and visibility
websocket_cluster.view	Read WebSocket cluster/application metadata and configured origins

The console calls object storage filesystems in its permission codes. Use filesystem.view, not an object-content or access-key permission. WebSocket reads use websocket_cluster.view; do not select the WebSocket application create, edit, or delete actions.

Ciphrix does not request:

• Create, edit, delete, or deployment actions, including deployment.create
• Organization management, billing, usage, or API token management permissions
• Credential-view permissions such as database_cluster_credential.view, cache_credential.view, filesystem_credential.view, or websocket_cluster_credential.view
• Environment-variable, command, deploy-hook, log, or metric access
• Access to stored object contents or bucket access-key management

Ciphrix makes read-only API requests. It does not deploy applications, change environment settings, run commands, modify resources, or connect to application databases and caches. Sensitive fields returned alongside resource metadata are removed before scan evidence or asset data is stored.

The resource scope you select determines coverage. An active token with restricted application/environment access does not provide organization-wide visibility. If a read still returns HTTP 403, review the failed operation with Ciphrix Support rather than granting broad write or credential access.

Managing the Integration

Rotating the Organization API Token

To rotate the token used by Ciphrix:

1. Create a new organization API token in the same Laravel Cloud organization with the six read permissions and the required resource scope
2. Go to Integrations in Ciphrix
3. Open the existing Laravel Cloud connection
4. Replace the saved Access Token
5. Click Update Credentials
6. Revoke the old token in Laravel Cloud after confirming a scan succeeds with the new token

Enabling or Disabling Asset Import

1. Open the Laravel Cloud connection in Integrations
2. Enable or disable Laravel Cloud Assets in the connection's items
3. When enabled, the next successful scheduled scan can import and update the supported resource inventory
4. Disabling the item stops future asset imports and updates; it does not delete assets already imported into Ciphrix

Revoking Access

To revoke Ciphrix's access to Laravel Cloud:

1. Open your Laravel Cloud organization's Settings > API tokens
2. Find the token created for Ciphrix
3. Click Revoke and complete any confirmation requested by Laravel Cloud
4. In Ciphrix, disable or delete the Laravel Cloud connection

Note: Revoking the token will prevent future Laravel Cloud scans from completing successfully.

Troubleshooting

Connection Failed

Issue: Credentials cannot be saved or Laravel Cloud scans cannot authenticate

• Confirm you pasted a Laravel Cloud organization API token, not a Sanctum token or object storage key
• Confirm the token has not expired or been revoked
• Ensure there are no extra spaces when copying the token
• Create a replacement token and click Update Credentials if the value may have been copied incorrectly
• If credentials cannot be saved, contact Ciphrix Support; changing Laravel Cloud permissions will not resolve every credential-storage problem

Permission Errors or HTTP 403 Responses

Issue: A scan cannot read some resources or configuration

• Confirm the token includes the six individual read permissions listed above
• Confirm its application/environment resource scope includes the resources being assessed
• Remember that token permissions do not automatically inherit the creator's user role
• Check plan availability for the feature being assessed
• Contact Ciphrix Support with the affected check and error details if reads are still denied. Do not send your token or grant write permissions as a workaround

No Resources Found

Issue: The connection is active but expected resources are missing

• Confirm the token was created in the organization that owns those resources
• Review the token's application/environment resource scope in Laravel Cloud
• Confirm the expected resources still exist
• An organization with no visible applications or other supported resources can return no-applicable-resource results. This does not prove that a security control is operating
• Changing the Ciphrix connection identifier does not change the token's access

Assets Are Not Appearing

Issue: Checks are visible but no Laravel Cloud assets have been imported

• Confirm Laravel Cloud Assets is enabled; it is off by default
• Wait for the next successful scheduled scan after enabling it
• Review scan results for denied reads, missing data, or incomplete collection; Ciphrix withholds incomplete asset inventories
• Confirm there are supported resources visible to the token

WebSocket Origins Check Fails

Issue: A WebSocket application has wildcard origins or an empty allowed-origin list

• Open the application's allowed-origin settings in Laravel Cloud
• Review the configured origins and remove wildcard entries
• An empty list does not satisfy Ciphrix's restricted-origin check
• Laravel Cloud also documents automatically allowing attached-environment origins. Do not assume this makes an empty configured list a restrictive policy; contact Support if the reported configuration is unexpected

Rate Limiting or Other Settings Cannot Be Verified

Issue: A check reports missing or unrecognized configuration

• Review the environment's edge network settings and your Laravel Cloud plan
• The rate-limit check looks for a positive threshold and an enforcing action: Challenge, Throttle, or Ban
• Missing or unrecognized values produce an error rather than an assumed pass or a claim that protection is disabled
• A configuration result is not an independent test of request blocking or plan entitlement
• Contact Ciphrix Support if the dashboard and reported configuration disagree

No Compliance Data Appearing

Issue: Integration connected but no compliance data is visible for more than 7 days

• Confirm the connection status is Active in Ciphrix
• Confirm the token is valid and still has the required permissions and resource scope
• Contact Ciphrix Support at support@ciphrix.com

Token Was Exposed

Issue: The Laravel Cloud API token may have been shared or exposed

• Revoke the token immediately in Laravel Cloud's organization API token settings
• Create a replacement token with the six read permissions and the intended resource scope
• Update the Laravel Cloud connection in Ciphrix with the new token

Support

Need help with Laravel Cloud integration?

• Email: support@ciphrix.com
• Token Setup and Resource Scoping: See Laravel Cloud API authentication
• Roles and Permissions: See Laravel Cloud roles and permissions
• Edge Network Settings and Plan Limits: See Laravel Cloud network documentation
• WebSocket Settings: See Laravel Cloud WebSockets documentation