Filament 2Fa Laravel Package

Product Decisions This Supports

• Security/compliance feature scoping. Admin-panel MFA is a checkbox on nearly every enterprise security questionnaire (SOC 2 CC6, ISO 27001 A.9, HIPAA, cyber-insurance renewals). This package answers "can we require MFA for privileged users?" with "yes, this sprint" instead of "next quarter."
• Build vs. buy for an authentication feature. The alternative is 1–3 weeks of engineering to wire Laravel Fortify's TOTP flow (secret generation, QR provisioning, confirmation, recovery codes) into Filament's panel auth screens, plus enforcement middleware. This is a thin, MIT-licensed adapter over a first-party Laravel package — buy it, audit it, and keep a fork path open.
• Roadmap slotting for "enterprise readiness." If your roadmap has an enterprise/self-hosted tier, SSO and MFA usually ship together. Treat this as the MFA half; it lets you sequence SSO separately rather than blocking the whole tier on one large identity project.
• Use-case fit. Strongest for internal admin back-offices, agency-built client portals, and multi-tenant SaaS operator panels — anywhere a compromised Filament login means broad data access. Weakest for consumer-facing auth, where the UX expectations and identity-provider integration differ.
• Support/risk resourcing. With 69 stars and zero dependents, decide up front who owns the vendored copy and the upgrade cadence when Filament ships a major version.

When to Consider This Package

Adopt when:

• You are already on Laravel + Filament + Fortify as your auth stack; the package assumes Fortify is the source of truth for 2FA state.
• You need TOTP + recovery codes (authenticator app), not passkeys or hardware keys.
• Your Filament version is explicitly listed as supported — verify the compatibility matrix against your composer.json before committing; Filament majors move fast and a single-maintainer plugin can lag.
• Your team can read and own ~a few hundred lines of MIT code. Budget a half-day audit of the enrollment flow, the confirmation step, and the panel-access middleware.
• The feature is a gate, not a differentiator — you want it done, stable, and invisible.

Look elsewhere when:

• You need SSO/SAML/OIDC, SCIM, or enterprise identity — go to WorkOS, Auth0, or a dedicated Filament SSO plugin. This package does not replace an IdP.
• You need WebAuthn/passkeys or hardware tokens; Fortify's 2FA is TOTP-only.
• Procurement requires a support contract, SLA, or vendor security review — there is no commercial backing here.
• You are not on Fortify (Breeze/Jetstream/custom auth) — the integration cost rises sharply and the buy case collapses.
• Your security bar forbids low-adoption dependencies in the auth path. Zero dependents means near-zero external battle-testing; you are the QA.

How to Pitch It (Stakeholders)

To executives: "We can turn on two-factor authentication for every admin-panel user — the thing blocking the security questionnaire and the enterprise deal — in days, not weeks, at effectively zero licensing cost. It's a small open-source add-on built on Laravel's own authentication library, and it's MIT-licensed, so we can take ownership of the code if the maintainer ever stops. The trade-off is that it's a small project with a single maintainer, so we'll pin the version and keep our own copy."

To engineering: "It's a thin Filament adapter over first-party Laravel Fortify — it gives us TOTP enrollment, QR provisioning, recovery codes, and panel-access enforcement without us rebuilding Fortify's UI in Filament. It adds one dependency to the auth path, so we audit the enrollment and middleware paths, pin the version, and vendor a fork. If Filament ships a breaking major, we may carry that fork for a release or two — a known, bounded cost."

The honest caveat to state up front: low adoption and a single maintainer mean you are accepting the maintenance tail in exchange for speed. That is a good trade for a compliance checkbox and a bad trade if MFA is central to your product's value.