---
title: "Events — Two-Factor for Laravel | Roundly"
description: "Nine events across enrolment, verification, recovery codes, replays and lockouts — each carries the user, never a secret or a code."
url: https://roundly-consulting.com/open-source/docs/two-factor-for-laravel/events
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Two-Factor for Laravel](https://roundly-consulting.com/open-source/docs/two-factor-for-laravel.md)

# Events

Every event lives in RoundlyConsulting\\TwoFactor\\Events and carries the user model as $user — never a secret or a code. A few add a non-sensitive detail:

| Event | Fired when | Payload |
| --- | --- | --- |
| `TwoFactorEnrolmentStarted` | start() persists a fresh pending secret. | user |
| `TwoFactorConfirmed` | confirm() enables 2FA. | user |
| `TwoFactorDisabled` | disable() clears all two-factor state. | user |
| `RecoveryCodesRegenerated` | recoveryCodes()->regenerate() replaces the code set. | user |
| `RecoveryCodeConsumed` | attempt() burns a recovery code; remaining is the count left. | user, remaining |
| `TwoFactorVerified` | A user passes a challenge, via TwoFactorMethod::Totp or ::RecoveryCode. | user, method |
| `TwoFactorVerificationFailed` | An enrolled user fails a challenge — not on a replay, not for a user without a secret. | user |
| `TwoFactorReplayDetected` | A code whose timestep was already used is rejected. | user, timestep |
| `TwoFactorRateLimited` | The built-in limiter locks a user out. | user, secondsUntilAvailable |

## Listening

TwoFactorVerified and TwoFactorVerificationFailed let you audit challenges, meter success and failure rates, and drive host-side lockout without wrapping the facade — for example a listener that increments a rate limiter:

```php
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\RateLimiter;
use RoundlyConsulting\TwoFactor\Events\TwoFactorVerificationFailed;

Event::listen(function (TwoFactorVerificationFailed $event): void {
    RateLimiter::hit("2fa:{$event->user->getKey()}");
});
```

Enrolment, disabling, recovery-code use and replay attempts are all announced too, so you can feed them into an audit log or alerting without extra plumbing.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/two-factor-for-laravel.md)