- How do I install adriaanzon/filament-passkeys in a Laravel app?
- Run composer require adriaanzon/filament-passkeys, then publish and run the upstream migration with php artisan vendor:publish --tag="passkeys-migrations" followed by php artisan migrate. Next, add the Laravel\Passkeys\Contracts\PasskeyUser contract and the PasskeyAuthenticatable trait to your Eloquent user model. Finally, register FilamentPasskeysPlugin::make() in the plugins array of your panel provider. There is no custom guard or extra middleware stack, so a mid-level Laravel developer can complete the whole integration in well under a day.
- Does this package support passwordless login with passkeys on the Filament login page?
- Yes. Calling FilamentPasskeysPlugin::make()->passwordlessLogin() adds a Sign in with passkey button and browser autofill support to the Filament v5 login page. The Remember me checkbox on the login form is honored when a user signs in with a passkey. To keep the profile-page management UI without prompting passkeys as an MFA step, also register PasskeyAuthentication::make()->managementOnly() in the panel's multiFactorAuthentication array.
- How do I add passkeys as a second factor in Filament v5 MFA?
- Register PasskeyAuthentication::make() inside the panel's multiFactorAuthentication([...]) call, alongside the FilamentPasskeysPlugin registration. Without the managementOnly() flag, the plugin contributes a passkey challenge step to Filament's multi-factor authentication flow. Users enroll an authenticator first from their profile page, then satisfy the challenge at login. If you only want passwordless sign-in, use managementOnly() so the challenge step is skipped while profile management stays intact.
- What Laravel and Filament versions does filament-passkeys require?
- The package targets Filament v5 panels and is built on top of laravel/passkeys, so it inherits that package's Laravel and PHP constraints. The README does not spell out an exact version matrix, so check the require block in composer.json before committing. Because the plugin hooks into Filament's login and profile pages, treat a Filament major or minor bump as a compatibility risk and re-test your panel after upgrading. There is no published CI matrix proving support across multiple versions.
- How do users register or remove passkeys from their Filament profile page?
- Enable ->profile() on your panel and the plugin adds passkey management to the user's profile page. From there, users register fingerprints, Face ID, device PINs, or hardware security keys, and can remove credentials they no longer use. The managementOnly() mode keeps this UI available even when passkeys are not used as an MFA challenge. If you have heavily customized the profile page, verify the plugin's view hooks survive your overrides before shipping.
- Do I need HTTPS and a Relying Party ID configured for WebAuthn to work?
- Yes. WebAuthn requires a secure context, so your panel must be served over HTTPS, and the Relying Party ID and expected origin must match the domain users actually visit. Those settings belong to laravel/passkeys configuration rather than this plugin, which only supplies the Filament UI and panel wiring. Origin or RP ID mismatches are the most common cause of failed passkey registration and sign-in, especially across staging domains, subdomains, or multi-tenant panels. Validate this in a staging environment with a real authenticator before going live.
- Can I use filament-passkeys alongside existing MFA, Fortify, or SSO-based login?
- The plugin assumes the default Filament authentication flow and composes with ->login() and ->profile(), making it a clean fit for a single panel on a standard Authenticatable user model. Fit degrades with multi-guard setups, custom login controllers, or panels fronted by an SSO broker, because the passkey button and MFA challenge are injected into Filament's own pages. Test your existing Fortify or TOTP-based flows side by side with the passkey challenge to confirm users are not prompted twice. Reviewing the plugin's view hooks against your overrides is the fastest way to spot conflicts.
- How do I test passkey authentication in my Laravel test suite?
- The README does not document a testing approach, and no CI or coverage details are published, so plan on writing your own feature tests around the flow. WebAuthn ceremonies depend on browser APIs and a real or virtual authenticator, which makes end-to-end passkey sign-in hard to fake in HTTP tests. Practical coverage means asserting that the login page exposes the passkey button, that the profile page lists credentials, and that guard behavior and remember-me work, plus manual verification with a real device. Check the upstream laravel/passkeys repository for any test helpers you can reuse.
- Is filament-passkeys production ready, and what are the alternatives?
- It is a thin, well-structured Filament layer over laravel/passkeys, but it has very few stars, no dependents, a single-author namespace, and a sparse release history, so there is little ecosystem validation. That is acceptable for an internal admin panel where you own the deployment, and risky for an unowned, internet-facing authentication path. Rate limiting and audit logging for the passkey endpoints are not documented, so confirm those yourself before exposing it publicly. The main alternative is wiring laravel/passkeys directly into a custom Filament login page, which gives you full control at the cost of writing the UI yourself.
- What happens if a user loses all their registered passkeys?
- The package README does not document an account-recovery path or an admin-side credential reset, so you need to design one before enforcing passkeys. Options include keeping password plus TOTP available as a fallback for privileged accounts and manually clearing the user's rows in the published passkeys table when a device is lost. If you make passkeys mandatory for super-admins, document the recovery runbook and the identity checks required before an admin removes a credential. Test the lost-device scenario in staging so support staff are not improvising during an incident.