---
title: "Events — Auth for Laravel | Roundly"
description: "42 events for every state change — all final readonly, carrying the guard and never a secret. The hooks for audit logs and statistics."
url: https://roundly-consulting.com/open-source/docs/auth-for-laravel/events
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Auth for Laravel](https://roundly-consulting.com/open-source/docs/auth-for-laravel.md)

# Events

All events live in RoundlyConsulting\\Auth\\Events, are final readonly, carry the guard name and never a secret — hook your audit log here:

| Group | Events |
| --- | --- |
| Login | LoginSucceeded, LoginFailed, LoginChallenged, ChallengeStepCompleted, ChallengeFailed, LoginThrottled, MagicLinkRequested, EmailOtpRequested, NewDeviceDetected, SuspiciousLoginDetected |
| Tokens & sessions | TokensIssued, TokensRefreshed, LoggedOut, AccountTokensInvalidated, RefreshTokenReuseReported |
| Account | AccountRegistered, AccountDisabled, AccountEnabled, AccountLocked, AccountUnlocked, LocaleUpdated, Reauthenticated |
| Passwords | PasswordResetRequested, PasswordReset, PasswordChanged, PasswordRehashed, BreachedPasswordCheckFailed |
| E-mail | EmailVerificationSent, EmailVerified, EmailChangeRequested (only when a link was issued — server-side, never show it to the requester), EmailChanged |
| Invitations | InvitationCreated, InvitationSent (only when the link was mailed), InvitationRevoked, InvitationAccepted |
| 2FA & passkeys | TwoFactorEnabled, TwoFactorDisabled, RecoveryCodesRegenerated, RecoveryCodeUsed, PasskeyAdded, PasskeyRemoved |
| Activity | LoginActivityRecorded (activityId, guard) |

AccountDisabled, AccountEnabled, AccountLocked, AccountUnlocked, PasswordChanged, TwoFactorDisabled and PasskeyRemoved also carry ?actor (their last field, a Model): who acted when it was not the account itself — the host passed actor:, e.g. an admin or a support tool. It is null for the account’s own changes, the HTTP endpoints, the automatic lockout and every call without actor:, and travels to queued listeners by identifier too.

```php
use Illuminate\Support\Facades\Event;
use RoundlyConsulting\Auth\Events\AccountRegistered;
use RoundlyConsulting\Auth\Events\AccountTokensInvalidated;

Event::listen(AccountRegistered::class, fn (AccountRegistered $event) => Statistics::increment('registrations'));

Event::listen(function (AccountTokensInvalidated $event): void {
    // $event->guard, ->account, ->reason (InvalidationReason), ->scope (InvalidationScope), ->revoked
});
```

Read $invitation->payload in an InvitationAccepted listener to assign roles, and enrich activity rows from LoginActivityRecorded. The lower packages keep firing their own events; Laravel’s Illuminate\\Auth\\Events are not dispatched (a Registered event would trigger Laravel’s verification mail on MustVerifyEmail models).

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/auth-for-laravel.md)