Verb for Laravel
Add an AI agent to your Laravel app
Quick answer
Paste Verb's script tag into resources/views/layouts/app.blade.php just before </body>, add a controller method that signs the authenticated user's id with hash_hmac and base64url without padding, and hand the token to the widget. The agent then does what your users ask through your existing routes, as them, confirming before any change.
Rather not do it by hand? Your coding agent can: see Verb for Claude Code or Cursor.
1. Add the script tag
Put it in resources/views/layouts/app.blade.php, just before </body>, once. Your site key is in the dashboard.
<script src="https://api.askverb.com/v1/verb.js"
data-verb-site="YOUR_SITE_KEY" defer></script>If you send a Content-Security-Policy, often through a middleware package, add https://api.askverb.com to script-src and connect-src.
2. Mint a token on your server
Verb treats every visitor as anonymous until your server says who they are. Sign the logged-in user's id and a short expiry with the key from your dashboard. Both halves are base64url without padding: standard base64 is the one mistake that fails every token while looking right in a log.
<?php
// routes/web.php: Route::get('/api/verb-token', [VerbController::class, 'token']);
class VerbController extends Controller
{
public function token(Request $request)
{
if (! $request->user()) {
return response()->json(['error' => 'unauthorized'], 401);
}
$claims = ['sub' => (string) $request->user()->id, 'exp' => time() + 900];
$body = $this->b64url(json_encode($claims));
$sig = $this->b64url(hash_hmac('sha256', $body, env('VERB_SIGNING_KEY'), true));
return response()->json(['token' => "{$body}.{$sig}"]);
}
// The '+/' to '-_' swap and the stripped '=' are both required.
private function b64url(string $raw): string
{
return rtrim(strtr(base64_encode($raw), '+/', '-_'), '=');
}
}3. Hand it to the widget
const getSessionToken = () =>
fetch("/api/verb-token", { credentials: "same-origin", cache: "no-store" })
.then(r => r.json())
.then(({ token }) => token);
// Sign in now, and let the widget ask again when the token gets old.
window.Verb.configure({ getSessionToken });
getSessionToken().then(token => token && window.Verb.identify(token));
// And wherever your app signs somebody out:
// window.Verb.reset();The widget asks for a fresh token before the old one expires, and clears the conversation when a different person signs in. The identity docs cover the details.
4. Describe what it may do, then test it
List the actions in a verb.md: each one says whether it reads or writes, and anything that writes asks the user for a yes with the real values first. Every site comes with a test site that only answers on localhost, so you try it against your development data before your users see it. Actions that need your app's own client go through an adapter.
Frequently asked questions
Will Laravel's CSRF protection block the agent's actions?
Reads are unaffected. For changes that go to CSRF-protected routes, mark those actions run: adapter, so they go through the same JavaScript your pages already use, which sends the X-CSRF-TOKEN header. A plain browser action does not add it, and Laravel would refuse the request.
Does it work with Livewire or Inertia?
Yes. The script sits in the layout every page renders through, so it loads once and stays as pages change.
Do I need to change my Laravel backend to add Verb?
Only one small endpoint that signs who is logged in. Everything the agent does goes through the API your app already has, as the signed-in user, so your existing routes, permissions and validation stay exactly as they are.
What happens if I skip the token step?
Reading works and every change is refused, because Verb treats every visitor as anonymous until your server says who they are. Users see an honest "you need to sign in" even though they are, which is the sign the token step is missing.