Passkeys for Filament

A Filament v5 panel plugin for passkey/WebAuthn authentication. Use passkeys as a second factor, as a passwordless sign-in option on the login page, or both. Users register passkeys (fingerprint, face, device PIN, security key) from their profile page. Built on top of laravel/passkeys.

Installation

1. Install the package via Composer:

   composer require adriaanzon/filament-passkeys
   

2. Publish and run the laravel/passkeys migration:

   php artisan vendor:publish --tag="passkeys-migrations"
   php artisan migrate
   

3. Add the PasskeyUser contract and PasskeyAuthenticatable trait to your user model:

   use Filament\Models\Contracts\FilamentUser;
   use Illuminate\Foundation\Auth\User as Authenticatable;
   use Laravel\Passkeys\Contracts\PasskeyUser;
   use Laravel\Passkeys\PasskeyAuthenticatable;
   
   class User extends Authenticatable implements FilamentUser, PasskeyUser
   {
       use PasskeyAuthenticatable;
   
       // ...
   }
   

4. Register the plugin on your panel. See Configuration for all available modes.

   use AdriaanZon\FilamentPasskeys\FilamentPasskeysPlugin;
   use AdriaanZon\FilamentPasskeys\PasskeyAuthentication;
   
   public function panel(Panel $panel): Panel
   {
       return $panel
           ->login()
           ->profile()
           // ...
           ->plugins([
               FilamentPasskeysPlugin::make()->passwordlessLogin(),
           ])
           ->multiFactorAuthentication([
               PasskeyAuthentication::make()->managementOnly(),
           ]);
   }
   

Configuration

This plugin supports the following setups:

• Passwordless sign-in only
• Passkey MFA
• Passwordless sign-in + passkey MFA

Passwordless sign-in only

A "Sign in with passkey" button + browser autofill on the login page, with passkeys excluded from Filament's MFA challenge. The login form's "Remember me" checkbox is honored when signing in with a passkey.

Users can register and manage passkeys from their profile page. The ->managementOnly() setting keeps that UI intact while skipping the MFA challenge step.

->plugins([
    FilamentPasskeysPlugin::make()->passwordlessLogin(),
])
->multiFactorAuthentication([
    PasskeyAuthentication::make()->managementOnly(),
]);

Passkey MFA

If you'd rather use passkeys as a second factor on top of password login (and not enable passwordless sign-in), drop both ->passwordlessLogin() and ->managementOnly():

->plugins([
    FilamentPasskeysPlugin::make(),
])
->multiFactorAuthentication([
    PasskeyAuthentication::make(),
])

Requiring MFA

Filament's isRequired argument works with passkeys too. Users without a passkey are prompted to set one up before they can use the panel:

->multiFactorAuthentication([
    PasskeyAuthentication::make(),
], isRequired: true)

[!WARNING] This doesn't work with ->managementOnly(): it excludes passkeys from MFA entirely, so users would get stuck on the set-up page even after registering one.

Fallback MFA method

When a user is unable to access their passkey, they cannot get past the MFA challenge and would be locked out. Pair PasskeyAuthentication with one of Filament's built-in providers like EmailAuthentication so they can still sign in:

use Filament\Auth\MultiFactor\Email\EmailAuthentication;

->multiFactorAuthentication([
    PasskeyAuthentication::make(),
    EmailAuthentication::make(),
])

Passwordless sign-in + passkey MFA

To use passkeys as both a login option and an MFA factor for password sign-ins, enable passwordless sign-in without ->managementOnly():

->plugins([
    FilamentPasskeysPlugin::make()->passwordlessLogin(),
])
->multiFactorAuthentication([
    PasskeyAuthentication::make(),
])

WebAuthn configuration

WebAuthn settings (relying party ID, allowed origins, user handle secret, timeout, throttling) live in laravel/passkeys's config/passkeys.php.

[!IMPORTANT] If you use Laravel Fortify, configure these settings in the passkeys array in config/fortify.php instead and skip the rest of this section. Fortify wraps laravel/passkeys and ignores any values in config/passkeys.php.

Publish the config with:

php artisan vendor:publish --tag="passkeys-config"

The passkeys.throttle value is applied to every passkey endpoint this plugin registers (defaults to throttle:6,1).

Changelog

Please see the releases for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Adriaan Zonnenberg
• All Contributors

License

The MIT License (MIT). Please see License File for more information.