Weave Code
Alt Google 2Fa Addon Laravel Package
alt-design/alt-google-2fa-addon
Add Google two-factor authentication to your control panel logins. Users pair an authenticator app by scanning a QR code, then enter a six-digit code at sign-in—a simple, strong second layer of protection that fits into the existing login flow.
Sets up Google 2FA (and others maybe??) on your Statamic site
Frequently asked questions about Alt Google 2Fa Addon
- What does alt-design/alt-google-2fa-addon do?
- It is a Statamic addon that adds TOTP-based two-factor authentication to the Statamic control panel login. Users pair an authenticator app such as Google Authenticator by scanning a QR code, then enter a six-digit code during sign-in. It layers onto the existing Statamic authentication flow rather than replacing it, so the login experience stays familiar. It is not a general-purpose Laravel 2FA package.
- How do I install alt-google-2fa-addon in a Statamic project?
- Install it with Composer via composer require alt-design/alt-google-2fa-addon, then publish the addon's config and migrations and run php artisan migrate. From there you enable enforcement per user or per role and have users enroll an authenticator app. The exact publish tags and config keys should be confirmed against the README for the version you pin.
- Does this package work with plain Laravel apps, or only Statamic?
- It only makes sense where Statamic owns the authentication surface, meaning the control panel login. If your application uses plain Laravel auth, Fortify, or Breeze, this is the wrong primitive and you should choose a Laravel-native 2FA package instead. It is a good fit for Statamic-powered sites and CMS-backed apps where editors and admins sign in through the CP.
- Which Statamic and Laravel versions does version 1.1.3 support?
- The 1.1.3 release is a Statamic version-constraint bump only, with no API changes, migrations, or new config keys. That suggests the maintainer is actively tracking upstream Statamic releases, which is a positive health signal for an addon. Before upgrading, verify the exact Statamic and Laravel ranges the new constraint permits and record the resolved matrix in your dependency register.
- Is two-factor authentication mandatory, opt-in, or role-scoped?
- The addon supports enabling enforcement per user or per role, so you can run it as an opt-in rollout or as a hard requirement for privileged accounts. Because this is a security control, verify the enforcement semantics in the source rather than relying on documentation alone. In particular, confirm what happens to a user who has not enrolled a secret while policy requires 2FA.
- How are the TOTP secrets stored?
- The package persists a per-user secret that the authenticator app derives codes from. Whether that secret is encrypted at rest using Laravel's encrypter or stored in a plaintext column is not stated in the release notes and must be verified in code before production use. Treat this as a blocking check for any security-critical deployment.
- Does it fail open or fail closed when a user has no enrolled secret?
- This is the single most important behaviour to validate, because a 2FA addon that silently fails open is worse than no 2FA at all. The release notes do not describe enforcement behaviour, so test explicitly: enable mandatory 2FA under policy, create a user without an enrolled secret, and confirm whether control panel access is blocked. Only then decide whether the addon meets your security bar.
- Are recovery codes or an admin break-glass reset supported?
- Recovery codes and locked-out user recovery are not described in the available release information, so assume nothing until you check the source and README. If recovery codes are supported, confirm they are hashed, single-use, and regenerable. If an admin or CLI reset path exists, confirm it is audited, since it is otherwise an easy bypass of the second factor.
- Can it run alongside Laravel Fortify or another 2FA package?
- Running two 2FA mechanisms in the same estate creates policy drift and confusing support load, so standardise on one. If Statamic owns the control panel login, this addon is the appropriate layer there. For API-first services or customer-facing auth, prefer a Laravel-native solution and avoid middleware collisions by keeping the two surfaces separate.
- Is it safe to adopt in production given the maintenance risk?
- The addon is published by a small vendor with a single contributing handle on the latest release, so bus factor and disclosure process are unknown. Because correctness is tied to Statamic internals such as the user repository and CP auth middleware, pin the addon to an exact version per environment. Roll it out additively in staging with a real CP login flow, keep a rollback window, and retire any previous 2FA path only after enrollment coverage is verified.
Weaver
How can I help you explore Laravel packages today?