---
title: "Installation — Passkeys for Laravel | Roundly"
description: "Install via Composer, publish and run the migrations, then set the relying-party ID and the allowed origins."
url: https://roundly-consulting.com/open-source/docs/passkeys-for-laravel/installation
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Passkeys for Laravel](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel.md)

# Installation

Require the package. The service provider is auto-discovered and the Passkeys facade alias is registered for you:

```bash
composer require roundly-consulting/passkeys-for-laravel
```

Migrations are publish-only — the package never loads them for you, so publishing is not optional. Two migrations are published: create\_passkeys\_table and the additive add\_attestation\_type\_to\_passkeys\_table:

```bash
php artisan vendor:publish --tag="passkeys-migrations"
php artisan migrate
```

If you rename the table (passkeys.table) or your passkey owners use UUID or ULID keys (passkeys.key\_type), publish the config and set those keys before migrating — the migration reads both.

## Optional publishes

Error messages ship in English and Slovak and follow the app locale. Publish the config to override defaults, and the translation lines to adjust the messages or add another language:

```bash
php artisan vendor:publish --tag="passkeys-config"
php artisan vendor:publish --tag="passkeys-translations"
```

## Required before the first ceremony

Two values are enforced the moment a ceremony runs. The relying-party ID falls back to the host of app.url; the origin allow-list has no default. A ceremony without either throws InvalidConfiguration:

```bash
PASSKEYS_RP_ID=example.com
PASSKEYS_ORIGINS=https://example.com,https://www.example.com
```

## Next steps

- Add the user-handle column and the InteractsWithPasskeys trait to your user model (see User model).
- Wire two endpoints per ceremony — options out, response in (see Registration and Authentication).
- Keep throttling, CSRF handling and session or token issuance in your application — the package ships none of them.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/passkeys-for-laravel.md)