Notifications

All notifications extend AuthenticationNotification and are sent by mail. Swap one per guard with notifications.classes.<type> (a subclass of AuthenticationNotification), or set it to null to disable it:

Delivery

• after_response (default) — a known account’s response is not measurably slower than an unknown one’s.
• queue — through an encrypted job (ShouldBeEncrypted) on notifications.connection / queue, so the plaintext link or code never sits readable in the queue store.
• sync — inline, for development.

Links

Emailed links are rendered from config only (no client-supplied redirect) with {frontend}, {app}, {guard}, {email} and {token}. The defaults put the secret in the URL fragment (#token=…), so it never reaches a server log or a Referer header — the frontend reads location.hash and POSTs the token. Do not use the log mail driver outside development.

'guards' => [
    'users' => [
        'model' => App\Models\User::class,
        'notifications' => [
            'delivery' => 'queue',       // sync|after_response|queue
            'queue' => 'mail',
            'classes' => [
                'magic_link' => App\Notifications\MagicLink::class,   // extends AuthenticationNotification
                'new_device' => null,                                  // null disables it
            ],
            'frontend_url' => 'https://app.example.com',
            'urls' => [
                'magic_link' => '{frontend}/auth/magic-link?guard={guard}#token={token}',
            ],
        ],
    ],
],

Copy and language

Copy lives in authentication::notifications.* — publish the translations to change it. Accounts get mail in their locale via preferredLocale():

php artisan vendor:publish --tag=authentication-translations