- How do I install asbiin/laravel-webauthn in a Laravel app?
- Require the package with Composer, publish its migrations, and run migrate to create the credentials table. Then add the WebAuthnAuthenticatable trait to your user model and wire up the package routes plus frontend JavaScript that calls navigator.credentials for registration and assertion. On a greenfield Laravel app this is genuinely low-effort, since the package ships the controllers, routes, events, and migration for you.
- Which Laravel and PHP versions does laravel-webauthn support?
- The package is a thin wrapper over web-auth/webauthn-lib, so its real constraints come from that upstream library. The 6.0.0 line tracks WebAuthn L3 and almost certainly raises the PHP floor to 8.2+ while pinning newer Symfony components, so Laravel 11 or 12 on PHP 8.3+ is the safest fit. Older Laravel 9 or 10 estates on PHP 8.1 are a poor fit without a platform upgrade, so confirm the exact PHP, Laravel, and webauthn-lib constraint matrix before committing.
- What changed in asbiin/laravel-webauthn 6.0.0?
- The assertion and attestation results now return CredentialRecord instead of the deprecated PublicKeyCredentialSource, following the WebAuthn L3 domain model. That is not a cosmetic rename: it ripples into custom credential repositories, event listeners that consume the returned object, and any persisted serialized credential payload. The release notes are a one-line changelog, so treat the upgrade as a real migration rather than a patch bump.
- Will upgrading to 6.0.0 break existing registered passkeys?
- It may. CredentialRecord and PublicKeyCredentialSource do not share an identical serialization shape, so if the package stores the credential object as JSON and hydration changed, existing enrolled passkeys could fail to deserialize and silently lose passwordless login. No data migration path is stated in the release notes, so treat that as the primary unknown. Inspect what your install actually persists and test with a real enrolled credential before sign-off.
- Can I use laravel-webauthn alongside normal password authentication?
- Yes. The package is additive by design: one table, one trait, a handful of routes, and it does not hijack the auth guard. That means WebAuthn can coexist with password and session authentication, letting you offer passkeys as an option rather than forcing users onto them.
- How do I add WebAuthn to my Laravel User model?
- Add the WebAuthnAuthenticatable trait provided by the package to your user model and publish the package migrations so the credentials table exists. The trait supplies the relationship and helper methods the registration and assertion ceremonies rely on. If you use a custom user model or repository, verify your code does not type-hint the old PublicKeyCredentialSource class after upgrading.
- Does laravel-webauthn work for API-only or SPA frontends?
- It is a weaker fit when the frontend is fully decoupled, such as headless or API-only deployments where you own the ceremony endpoints. The package is happiest in a standard Laravel monolith or modular monolith with Blade or Inertia and session-based auth. If your SPA needs custom ceremony handling, you may be better off using web-auth/webauthn-lib directly.
- How do I test WebAuthn authentication in Laravel?
- Standard PHPUnit fakes cannot meaningfully validate WebAuthn ceremonies, so real confidence requires a virtual authenticator. Use Playwright or the Chrome DevTools Protocol WebAuthn domain to simulate registration and assertion in automated tests, and supplement with manual testing on real devices for Touch ID, Face ID, and security keys. Budget ongoing effort for this, since it is a chronic testing cost rather than a one-time setup.
- Can laravel-webauthn be used in a multi-tenant application?
- Not without extra work. The package is not appropriate for multi-tenant setups unless you verify how Relying Party ID and origin handling behave per tenant, since WebAuthn credentials are bound to those values. If tenants live on separate domains, plan to validate or extend the RP configuration yourself before relying on the package.
- Is asbiin/laravel-webauthn actively maintained, and are there alternatives?
- It is a single-maintainer package riding a fast-moving upstream, and major bumps have been frequent and under-documented, so expect 6.x not to be the last breaking release this year. Ask whether the 5.5.x line still receives security fixes and for how long. Alternatives include integrating web-auth/webauthn-lib directly, which gives you full control over the ceremony endpoints at the cost of writing the Laravel glue yourself.