Events

All events live in RoundlyConsulting\Auth\Events, are final readonly, carry the guard name and never a secret — hook your audit log here:

AccountDisabled, AccountEnabled, AccountLocked, AccountUnlocked, PasswordChanged, TwoFactorDisabled and PasskeyRemoved also carry ?actor (their last field, a Model): who acted when it was not the account itself — the host passed actor:, e.g. an admin or a support tool. It is null for the account’s own changes, the HTTP endpoints, the automatic lockout and every call without actor:, and travels to queued listeners by identifier too.

use Illuminate\Support\Facades\Event;
use RoundlyConsulting\Auth\Events\AccountRegistered;
use RoundlyConsulting\Auth\Events\AccountTokensInvalidated;

Event::listen(AccountRegistered::class, fn (AccountRegistered $event) => Statistics::increment('registrations'));

Event::listen(function (AccountTokensInvalidated $event): void {
    // $event->guard, ->account, ->reason (InvalidationReason), ->scope (InvalidationScope), ->revoked
});

Read $invitation->payload in an InvitationAccepted listener to assign roles, and enrich activity rows from LoginActivityRecorded. The lower packages keep firing their own events; Laravel’s Illuminate\Auth\Events are not dispatched (a Registered event would trigger Laravel’s verification mail on MustVerifyEmail models).