Provably fair coin flip system in Laravel
So why are you saving both the $secret and the hash of the $secret in the DB? 

$bet-&gt;secret_key = $secret;
$bet-&gt;secret_hash = hash('sha256', $secret);


Also how does the hash of the $secret allow you to ensure that the outcome is fair? Do you ever use this hash anywhere?

Also carrying out any critical operations that you expect to remain secure on a client that allows someone to view and alter the code via a console cannot be considered secure. Basically the game should be run entirely on the server with input from the clients, such as the bet amount and bet acceptance, and then the results can be distributed to the clients for display.

Do you have some mathematical proof showing that the distribution of numbers in the second position of a string generated from a HMAC hash after non-number characters are removed is actually random? If not then you cannot assert that this method is truly random and would give you the 50/50 chance you desire.

Since PHP already has a built int cryptographically secure pseudo-random integer generator, int random_int ( int $min , int $max ), why don't your just use that to generate you numbers between 0 and 9?