Weave Code
Alt Google 2Fa Laravel Package
alt-design/alt-google-2fa
A Laravel package for adding Google Two-Factor Authentication to your application. It generates and verifies TOTP codes, helping secure user accounts with a simple, configurable 2FA workflow that integrates cleanly into existing Laravel projects.
Sets up Google 2FA (and others maybe??) on your Statamic site
Frequently asked questions about Alt Google 2Fa
- How do I install alt-design/alt-google-2fa on a Statamic site?
- Install it with Composer via composer require alt-design/alt-google-2fa, then publish the addon's config and assets using the standard Statamic addon publish commands. Because it registers through an addon service provider that hooks the control panel authentication flow, you do not need to change your application's domain code. After publishing, configure the enforcement policy and enroll users. Verify login and enrollment end-to-end against your exact pinned Statamic version before enforcing anything.
- Which Statamic and Laravel versions does this 2FA addon support?
- The addon targets Statamic 3, 4, and 5 on a PHP 8.x baseline with a supported Laravel version, but the exact range depends on the Composer constraint shipped in the release you install. Version 1.1.3 changed only the Statamic dependency constraint, and the notes do not state whether it widened or narrowed support. Run composer why-not alt-design/alt-google-2fa-addon before upgrading to see exactly what your lockfile resolves to.
- Does this package work in a plain Laravel app without Statamic?
- Not out of the box. Despite the Laravel-package framing, it ships as a Statamic addon that registers through an addon service provider and hooks the Statamic control panel authentication flow, so it assumes Statamic is present. If you need TOTP two-factor authentication in a standalone Laravel application, use a dedicated package such as pragmarx/google2fa-laravel or Laravel Fortify's two-factor feature instead.
- Is 2FA opt-in per user or can I enforce it for all control panel users?
- The addon supports a configurable enforcement policy, so you can run it as optional per-user enrollment or require it for everyone in the control panel. In practice, roll it out in stages: pilot with two or three super users, then editors, then the broader control panel population, keeping an optional period before enforcement so enrollment failures surface as support tickets rather than lockouts. Confirm per-role enforcement behavior in staging before turning it on globally.
- Are TOTP secrets encrypted at rest in the database?
- The package overview does not state how secrets are stored, so verify this before rollout. Check the published migration or user field schema and confirm whether secrets are encrypted via Laravel's encrypter or written in plaintext. If they are not encrypted, decide whether that is acceptable for your threat model or add encryption at the storage layer.
- Does the addon support recovery or backup codes?
- Recovery code support is not documented in the available release information, so treat it as an open question and test it explicitly in staging. Without backup codes, a lost device means a manual admin reset, so document that path before you enforce 2FA. Ask the maintainer whether recovery codes exist and how they are generated, stored, and invalidated.
- How do I reset 2FA for a user who is locked out?
- There is no documented break-glass path in the available notes, so establish one before enforcing the policy. Typically this means an administrator clearing the user's stored TOTP secret or 2FA flag directly, which should be scripted and logged for audit. Write the help-desk procedure and rehearse it during the pilot so a lost phone does not become an outage.
- Is this package safe to use in production?
- It is a thin, additive authentication control with a low blast radius for Statamic sites, but 2FA is a security-critical surface where it works is harder to verify than it compiles. Risks include a single-maintainer project, an untested dependency bump in 1.1.3, and unclear secret storage. Mitigate by staging the rollout, verifying enrollment and admin reset paths, and pinning the version you have validated.
- How do I test 2FA enrollment without locking myself out?
- Stage the install and verify control panel login plus enrollment end-to-end against your exact Statamic version first. Confirm secret storage and recovery behavior in both the database and the UI, and check that your application servers have working NTP clock sync so TOTP codes validate. Pilot with two or three super users and keep a tested admin reset path ready before you enforce the policy for anyone else.
- Is the package actively maintained, and what is its release cadence?
- Version 1.1.3 contained a single pull request from the maintainer that only bumped the Statamic version constraint, with no code changes, features, or security advisories. That points to a small project with vendor concentration and bus-factor risk, so review issue responsiveness, release history, and license status before adopting it. Pin the version you validate and revisit it deliberately during each Statamic major upgrade rather than letting the constraint drift.
Weaver
How can I help you explore Laravel packages today?