--- title: "Auth for Laravel — docs | Roundly" description: "Developer docs for Auth for Laravel: password, magic link, email code and passkey login, 2FA challenges, JWT sessions, invitations and a JSON API." url: https://roundly-consulting.com/open-source/docs/auth-for-laravel language: en --- [All packages](https://roundly-consulting.com/open-source.md) Open source # Auth for Laravel Install `composer require roundly-consulting/auth-for-laravel` Requires: PHP ^8.4 · Laravel ^12.0|^13.0 [GitHub](https://github.com/roundly-consulting/auth-for-laravel) [Packagist](https://packagist.org/packages/roundly-consulting/auth-for-laravel) [Donate (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Patreon](https://www.patreon.com/cw/roundly) ## Overview Headless, multi-guard account authentication for Laravel APIs. Password, magic-link, email-code and passkey login; a challenge engine for two-factor and forced enrolment; RS256 access tokens with rotating refresh tokens and device sessions; registration, invitations, email verification and password flows — with opt-in JSON endpoints and an event for every state change. It owns no cryptography and no token format: it composes the Roundly jwt, refresh-tokens, two-factor, passkeys, crypto and qr packages and adds the policy and orchestration on top. MIT-licensed, built only on official Laravel components and Roundly packages — no third-party auth vendors. ### What you get #### Four ways to sign in Password, magic link, email code and passwordless passkeys — each switchable per guard. #### Challenge engine Multi-step logins with TOTP, recovery-code and passkey second factors, plus forced enrolment during sign-in. #### JWT + rotating sessions RS256 access tokens with amr, auth\_time and sid; rotating refresh tokens and per-device sessions you can end one by one. #### Isolated guards Users, clients, staff — each with its own model, audience, throttles, routes and activity. A token of one never works on another. #### Sign-up, invites & email Open, invite-only or closed registration, invitations with payloads, email verification and a verified email change. #### Enumeration-safe by design Identical answers and timing for known and unknown accounts, HMAC’d secrets at rest, throttling and opt-in lockout. #### JSON API, facade & events Opt-in endpoints per guard, the same flows from PHP through the Authentication facade, DI or actions, and an event for every state change — naming the admin when one acted. ### Documentation #### [Installation](https://roundly-consulting.com/open-source/docs/auth-for-laravel/installation.md) Install via Composer, generate the JWT keys, run the installer, wire the jwt guard and user provider, prepare the model and run the doctor. #### [Configuration](https://roundly-consulting.com/open-source/docs/auth-for-laravel/configuration.md) Every global and per-guard config key with its default — login methods, 2FA, passkeys, tokens, registration, throttles and more. #### [Guards](https://roundly-consulting.com/open-source/docs/auth-for-laravel/guards.md) Isolated audiences of accounts — each with its own model, table, JWT audience, sessions, throttles and routes — and how to add one. #### [Account model](https://roundly-consulting.com/open-source/docs/auth-for-laravel/account-model.md) The Account contract, the HasAuthentication trait, the account columns, account lookups and the disable, lock and locale lifecycle. #### [The Authentication facade](https://roundly-consulting.com/open-source/docs/auth-for-laravel/programmatic-api.md) Tour the Authentication facade — per-guard login and session verbs, seven area sub-contexts, scoping rules and login results. #### [DI and actions](https://roundly-consulting.com/open-source/docs/auth-for-laravel/without-facade.md) Skip the facade: inject AuthenticationManager or call a single-purpose action with the guard name first — the full facade method → action map. #### [Login methods](https://roundly-consulting.com/open-source/docs/auth-for-laravel/login-methods.md) Password, magic link, email code and passwordless passkey login — what each does, how it is throttled and what every login goes through. #### [Login challenges](https://roundly-consulting.com/open-source/docs/auth-for-laravel/challenges.md) The multi-step challenge engine — second factors, passkey steps and forced enrolment, the policy that picks them and how state stays safe. #### [Tokens & sessions](https://roundly-consulting.com/open-source/docs/auth-for-laravel/tokens-sessions.md) RS256 access tokens and their claims, rotating refresh tokens, device sessions, logouts and the invalidation policy. #### [Re-authentication](https://roundly-consulting.com/open-source/docs/auth-for-laravel/reauthentication.md) A “sudo mode” before sensitive actions — available methods, the second-factor strength rule, gated actions and the route middleware. #### [Two-factor & passkeys](https://roundly-consulting.com/open-source/docs/auth-for-laravel/two-factor-passkeys.md) Let signed-in accounts manage TOTP, recovery codes and passkeys — with re-authentication, invalidation, events and notifications. #### [Registration & invitations](https://roundly-consulting.com/open-source/docs/auth-for-laravel/registration-invitations.md) Open, invite-only or closed sign-up with your own fields and account creator, plus invitations with payloads, previews and resend limits. #### [Email & passwords](https://roundly-consulting.com/open-source/docs/auth-for-laravel/email-passwords.md) One-time links and codes, email verification modes, verified email change, the password policy, breached-password check and reset flows. #### [Activity & risk](https://roundly-consulting.com/open-source/docs/auth-for-laravel/activity-risk.md) Throttling, opt-in lockout, the login-activity log, new-device detection, pluggable risk assessment and pruning. #### [Locale & timezone](https://roundly-consulting.com/open-source/docs/auth-for-laravel/locale.md) Negotiate each request’s locale, store the account’s locale and timezone, and send every notification in the account’s language. #### [HTTP API](https://roundly-consulting.com/open-source/docs/auth-for-laravel/http-api.md) Opt-in JSON endpoints per guard — registration, route groups, every endpoint with its body, response shapes, error codes and how to reshape them. #### [Middleware](https://roundly-consulting.com/open-source/docs/auth-for-laravel/middleware.md) Six middleware aliases — bind a guard, require a verified or active account, demand a recent re-authentication and apply the locale. #### [Events](https://roundly-consulting.com/open-source/docs/auth-for-laravel/events.md) 42 events for every state change — all final readonly, carrying the guard and never a secret. The hooks for audit logs and statistics. #### [Notifications](https://roundly-consulting.com/open-source/docs/auth-for-laravel/notifications.md) 20 localizable mail notifications — swap or disable any per guard, deliver after the response or on an encrypted queue. #### [Extending](https://roundly-consulting.com/open-source/docs/auth-for-laravel/extending.md) Swap claims, account creation, registration rules, risk, QR, locale, breach checks and fingerprints — plus models and resources. #### [Artisan commands](https://roundly-consulting.com/open-source/docs/auth-for-laravel/commands.md) Install and wire, scaffold new guards, run the configuration doctor, prune old data and log an account out everywhere. #### [Testing](https://roundly-consulting.com/open-source/docs/auth-for-laravel/testing.md) Act as an account with a real token pair, assert domain events with Event::fake(), and check login activity and token invalidation. #### [Security](https://roundly-consulting.com/open-source/docs/auth-for-laravel/security.md) Guard isolation, enumeration safety, single-use secrets, invalidation and recovery safeguards — and the known limits. #### [Requirements](https://roundly-consulting.com/open-source/docs/auth-for-laravel/requirements.md) PHP 8.4+, Laravel 12 or 13, OpenSSL, bcmath and mbstring, an RSA key pair, a cache with atomic locks and a mail transport. ## Show your open-source love This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented. [More ways to support, including crypto](https://roundly-consulting.com/support-us.md) By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md). [Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly) ## Want this built into your product? We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours. [Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source.md)