---
title: "Extending — Auth for Laravel | Roundly"
description: "Swap claims, account creation, registration rules, risk, QR, locale, breach checks and fingerprints — plus models and resources."
url: https://roundly-consulting.com/open-source/docs/auth-for-laravel/extending
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Auth for Laravel](https://roundly-consulting.com/open-source/docs/auth-for-laravel.md)

# Extending

Every extension point is a contract bound per guard in config, or globally in the container:

| Contract | Bound via | Purpose |
| --- | --- | --- |
| `ResolvesAccessTokenClaims` | `tokens.claims_resolver` | resolve(Account, GuardConfig): AccessTokenClaims — email, permissions, extra claims. |
| `CreatesAccounts` | `registration.creator` | create(GuardConfig, NewAccountData): Account — registration and invitation acceptance. |
| `ProvidesRegistrationRules` | `registration.rules` | rules(GuardConfig): array — host fields; only these keys reach the creator. |
| `AssessesLoginRisk` | `risk.assessor` | assess(LoginRiskContext): RiskAssessment. |
| `RendersQrCode` | container | otpauthSvg(uri, size): ?string (null never blocks enrolment). |
| `NegotiatesLocale` | container | negotiate(Request, GuardConfig): ?string. |
| `ChecksBreachedPasswords` | container | isBreached(password, GuardConfig): bool. |
| `FingerprintsDevices` | container | fingerprint(SessionContext, GuardConfig): ?string. |

Container defaults are bound with bindIf, so a binding in your own provider wins:

```php
// App\Providers\AppServiceProvider::register()
use RoundlyConsulting\Auth\Contracts\ChecksBreachedPasswords;
use RoundlyConsulting\Auth\Contracts\FingerprintsDevices;

$this->app->bind(ChecksBreachedPasswords::class, MyBreachChecker::class);
$this->app->bind(FingerprintsDevices::class, MyDeviceFingerprinter::class);
```

A notification swapped through notifications.classes.<type> inherits the by\_actor copy choice and can read $this->data->actor (an ActorData; ->resolve() returns the model) to name who acted — see Notifications.

## Models and resources

The four models may point at subclasses of the packaged ones — the subclass is the class created and queried everywhere, the package factories included. Any other class throws an InvalidConfigurationException naming the key; it never silently falls back to the packaged model. The JSON resources are non-final, and resources.account swaps the me resource per guard:

```php
// config/authentication.php
'models' => [
    'challenge' => LoginChallenge::class,
    'one_time_token' => OneTimeToken::class,
    'invitation' => App\Models\Invitation::class,   // extends RoundlyConsulting\Auth\Models\Invitation
    'login_activity' => LoginActivity::class,
],

'guards' => [
    'users' => [
        'model' => App\Models\User::class,
        'resources' => ['account' => App\Http\Resources\CurrentUserResource::class],
    ],
],
```

## Not extension points

The token formats (jwt, refresh-tokens), the two-factor and passkey ceremonies and the cryptographic primitives belong to the lower packages.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/auth-for-laravel.md)