--- title: "Passkeys for Laravel — docs | Roundly" description: "Developer docs for Passkeys for Laravel: WebAuthn registration and sign-in, second factor, attestation, passkey management, events and testing." url: https://roundly-consulting.com/open-source/docs/passkeys-for-laravel language: en --- [All packages](https://roundly-consulting.com/open-source.md) Open source # Passkeys for Laravel Install `composer require roundly-consulting/passkeys-for-laravel` Requires: PHP ^8.4 · Laravel ^12.0|^13.0 [GitHub](https://github.com/roundly-consulting/passkeys-for-laravel) [Packagist](https://packagist.org/packages/roundly-consulting/passkeys-for-laravel) [Donate (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Patreon](https://www.patreon.com/cw/roundly) ## Overview A native WebAuthn / FIDO2 passkey relying party for Laravel. It builds the options the browser needs, verifies the signed responses that come back, and stores each credential against the right user — following the WebAuthn Level 2 ceremonies, with ES256, RS256 and EdDSA credentials. It is deliberately controller-less: your application keeps its routes, UI, throttling and session or token issuance. MIT-licensed, with no third-party crypto — the cryptography runs on Roundly’s own crypto-for-laravel. ### What you get #### Facade, DI or actions Two-call ceremonies on the Passkeys facade — or inject PasskeyService, or run the single-purpose actions directly. #### Usernameless & second factor Discoverable login by default; user-bound options and owner expectations for step-up and multi-guard apps. #### No third-party crypto ES256, RS256 and opt-in EdDSA verified through Roundly’s own crypto-for-laravel — no external WebAuthn library. #### Attestation trust ladder ignore, self or basic — packed and Apple formats, shipped Apple and Google roots, AAGUID allow-lists. Configuration, not code. #### Hardened by default Single-use, ceremony-bound challenges, origin and RP ID checks, a forward-only sign counter for clone detection and no user enumeration. #### Ownership-checked management Passkeys::for($user) lists, renames and revokes only that account’s passkeys — plus a display-safe PasskeyResource and audit events. #### Testing built in A recording Passkeys::fake() with assertions for every ceremony, plus a software VirtualAuthenticator for real end-to-end runs. ### Documentation #### [Installation](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/installation.md) Install via Composer, publish and run the migrations, then set the relying-party ID and the allowed origins. #### [Configuration](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/configuration.md) Every config key with its env variable and default — relying party, origins, algorithms, challenges, attestation trust and user wiring. #### [User model](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/user-model.md) Add the opaque user-handle column, implement HasPasskeys with the InteractsWithPasskeys trait, and run ceremonies straight off the user. #### [The Passkeys facade](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/facade.md) The whole public API on one facade — Passkeys::for($user) for everything scoped to an account, flat calls for the usernameless login. #### [DI and actions](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/without-facade.md) Inject PasskeyService for the same API without static calls, or run a ceremony’s single-purpose action directly from trusted code. #### [Registration](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/registration.md) Build creation options for navigator.credentials.create(), verify the attestation response and persist the credential with a friendly name. #### [Authentication](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/authentication.md) Usernameless or user-bound sign-in — build request options, verify the assertion and start your own session from the resolved credential. #### [Second factor & owner expectations](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/second-factor.md) Ask a known account for its own passkey, demand user verification for one step, and restrict sign-in to one owner type in multi-guard apps. #### [Managing passkeys](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/managing-passkeys.md) Everything a “your passkeys” screen needs — list, rename and revoke credentials, and serialise them safely with PasskeyResource. #### [Passkey model & schema](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/passkey-model.md) The soft-deleting, polymorphic Passkey model — scopes, casts, hidden attributes, the table schema and swapping in your own model. #### [Algorithms & Ed25519](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/algorithms.md) ES256 and RS256 out of the box, Ed25519 (EdDSA) as an opt-in with ext-sodium — and no unvetted algorithm is ever accepted. #### [Attestation](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/attestation.md) Prove what an authenticator is — a three-tier trust ladder, packed and Apple formats, shipped roots and AAGUID allow-lists, all in config. #### [Events](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/events.md) Five events for audit trails and anomaly handling — registered, authenticated, counter regressed, revoked and renamed. #### [Exceptions](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/exceptions.md) One PasskeyException base with typed children for ceremony, configuration, decoding and attestation failures — with localisable messages. #### [Enums](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/enums.md) Reference for every enum — user verification, resident key, attachment, attestation conveyance, trust and type, sign-count policy. #### [Extending](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/extending.md) Swap the challenge store, add an attestation format, replace the trust policy or implement HasPasskeys yourself — all through container bindings. #### [Security model](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/security.md) What the relying party enforces on every ceremony — challenges, origins, signatures, counters, enumeration — and what it leaves to you. #### [Testing](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/testing.md) Record and assert ceremonies with Passkeys::fake(), or run real ceremonies end to end with the software VirtualAuthenticator. #### [Requirements](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/requirements.md) PHP 8.4+, Laravel 12 or 13 and ext-json — plus ext-sodium only if you enable Ed25519 credentials. ## Show your open-source love This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented. [More ways to support, including crypto](https://roundly-consulting.com/support-us.md) By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md). [Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly) ## Want this built into your product? We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours. [Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source.md)