---
title: "Events — Passkeys for Laravel | Roundly"
description: "Five events for audit trails and anomaly handling — registered, authenticated, counter regressed, revoked and renamed."
url: https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/events
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Passkeys for Laravel](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel.md)

# Events

The package dispatches five synchronous events in RoundlyConsulting\\Passkeys\\Events. Each carries only safe identifiers through the Passkey model — never key material:

| Event | Payload | Fired when |
| --- | --- | --- |
| `PasskeyRegistered` | $passkey | A registration verified and the credential was persisted. |
| `PasskeyAuthenticated` | $passkey | An assertion verified successfully. |
| `PasskeySignCountRegressed` | $passkey, $stored, $received | The counter didn’t advance and sign\_count\_policy is flag. |
| `PasskeyRevoked` | $passkey | After revoke() soft-deleted the credential. |
| `PasskeyRenamed` | $passkey, $previousName | After rename() saved the new name. |

Listen the usual Laravel way:

```php
use Illuminate\Support\Facades\Event;
use RoundlyConsulting\Passkeys\Events\PasskeyAuthenticated;
use RoundlyConsulting\Passkeys\Events\PasskeyRenamed;
use RoundlyConsulting\Passkeys\Events\PasskeyRevoked;
use RoundlyConsulting\Passkeys\Events\PasskeySignCountRegressed;

Event::listen(function (PasskeyAuthenticated $event): void {
    $user = $event->passkey->authenticatable;
    // audit-log a successful passkey sign-in
});

Event::listen(function (PasskeySignCountRegressed $event): void {
    // possible cloned authenticator — alert / lock / require re-enrolment
    logger()->warning('Passkey counter regressed', [
        'passkey' => $event->passkey->id,
        'stored' => $event->stored,
        'received' => $event->received,
    ]);
});

Event::listen(function (PasskeyRevoked $event): void {
    // e.g. end sessions established with this credential, notify the owner
});

Event::listen(function (PasskeyRenamed $event): void {
    // audit: $event->previousName → $event->passkey->name
});
```

PasskeySignCountRegressed fires only under the flag policy; under reject the regression throws SignCountRegression instead. The stored counter is never lowered, so a cloned authenticator is flagged on every assertion it makes, not just the first. Passkeys::fake() fires them too — PasskeyRegistered and PasskeyAuthenticated on a successful fake register() / authenticate(), PasskeyRevoked and PasskeyRenamed from the real management actions — so your listeners run under the fake unless the test wraps them in Event::fake(). PasskeySignCountRegressed needs the real verifier; the fake has no counter.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel.md)