Mercure Broadcasting in Laravel 13.32Mercure Broadcasting in Laravel 13.32

Reducing reliance on an external service

When an application needs live UI updates, the usual choice is often Pusher or a WebSocket server that I have to run myself. Laravel 13.32 adds Mercure as a broadcasting driver and provides another option: publishing events through Server-Sent Events. I find this especially useful when I want the hub to remain in infrastructure I control, such as a homelab or an existing server. (laravel-news.com)

A separate hub that I can operate

Mercure is built around a hub that receives updates from Laravel and subscriptions from browser clients. Laravel distinguishes between the internal publishing URL and the public URL used by the browser, which matters when the application and hub sit on different networks or DNS names. The JWT secret configured in Laravel must match the one configured on the hub. (laravel.com)

The minimum configuration

The connection is enabled with BROADCAST_CONNECTION=mercure. MERCURE_URL is the endpoint Laravel uses to publish updates, while MERCURE_PUBLIC_URL is the address used by browser clients. I would keep these values out of application code and avoid sharing the hub secret with unrelated services without checking the isolation around it first.

BROADCAST_CONNECTION=mercure
 
MERCURE_URL=https://mercure.example.com/.well-known/mercure
MERCURE_PUBLIC_URL=https://mercure.example.com/.well-known/mercure
MERCURE_JWT_SECRET=<your-mercure-jwt-secret>
 
VITE_MERCURE_HUB_URL="${MERCURE_PUBLIC_URL}"

Laravel’s documentation states that the hub must use the same JWT secret. It also makes the distinction between the URL used by PHP and the one exposed to the browser explicit, which is easy to get wrong when a reverse proxy is involved. (laravel.com)

Echo understands Mercure too

On the frontend, I do not need a separate client library just to receive these events: Laravel Echo includes a mercure broadcaster. Installing laravel-echo and creating an Echo instance with that broadcaster and the hub host is enough. When no host is provided, Echo defaults to /.well-known/mercure on the current origin. (laravel.com)

That keeps the application layer reasonably familiar. Events still implement ShouldBroadcast, while public and private channels remain Laravel concepts instead of becoming a new API to learn. From a domain-code perspective, switching transport should not require redesigning every event. (laravel.com)

Private channels, presence, and encryption

Private channels retain the authorization rules defined in routes/channels.php, so knowing a channel name is not enough to subscribe to it. Presence channels follow the same overall model: authorization may return user information, and Echo provides here, joining, and leaving callbacks to reflect who is connected. That covers practical cases such as a support room, collaborative editing, or an operator dashboard without leaving Laravel’s broadcasting model. (laravel.com)

For end-to-end encrypted private channels, Laravel documents MERCURE_ENCRYPTION_KEY. It must be a 32-byte key, so I would not generate it from a short password or paste an environment value without validating its format. Encryption is an extra layer, not a replacement for correct channel authorization or hub protection. (laravel.com)

The fine print

Mercure does not remove the operational work of running another component: the hub still needs deployment, updates, monitoring, protected secrets, and a properly exposed public URL. It also does not turn SSE into a bidirectional channel; when the browser needs to send an action back to the server, it will still use HTTP or another mechanism chosen by the application. Mercure makes sense when server-to-client delivery is the main requirement, not as an automatic WebSocket replacement.

It is also worth remembering that Laravel normally broadcasts through queued jobs. A worker has to be running, and events emitted inside database transactions need thought if the data has not been committed yet. Mercure simplifies the transport layer, but it does not solve event design or data consistency by itself. (laravel.com)

Source: Laravel News (laravel-news.com) Official Laravel Broadcasting documentation (laravel.com)