Installation

Require the package. The service provider is auto-discovered and the Passkeys facade alias is registered for you:

composer require roundly-consulting/passkeys-for-laravel

Migrations are publish-only — the package never loads them for you, so publishing is not optional. Two migrations are published: create_passkeys_table and the additive add_attestation_type_to_passkeys_table:

php artisan vendor:publish --tag="passkeys-migrations"
php artisan migrate

If you rename the table (passkeys.table) or your passkey owners use UUID or ULID keys (passkeys.key_type), publish the config and set those keys before migrating — the migration reads both.

Optional publishes

Publish the config to override defaults, and the translation lines to localise every error message:

php artisan vendor:publish --tag="passkeys-config"
php artisan vendor:publish --tag="passkeys-translations"

Required before the first ceremony

Two values are enforced the moment a ceremony runs. The relying-party ID falls back to the host of app.url; the origin allow-list has no default. A ceremony without either throws InvalidConfiguration:

PASSKEYS_RP_ID=example.com
PASSKEYS_ORIGINS=https://example.com,https://www.example.com

Next steps

• Add the user-handle column and the InteractsWithPasskeys trait to your user model (see User model).
• Wire two endpoints per ceremony — options out, response in (see Registration and Authentication).
• Keep throttling, CSRF handling and session or token issuance in your application — the package ships none of them.