- How do I install the Aura Starter Kit for a new Laravel app?
- It is consumed at project-creation time with the Laravel installer using the --using flag: laravel new my-app --using=bluestarsystem/aura-starter-kit. You do not run composer require into an existing project, because the package is scaffolding rather than a runtime library. After the command finishes you get a full application skeleton with Aura UI components, Livewire, Tailwind CSS 4, and dark mode already wired up, and you simply delete the parts you do not want.
- Can I install the Aura Starter Kit into my existing Laravel application?
- Not as an installable artifact. Because it is a starter kit, there is no Composer dependency to add or bump, so adopting it in a brownfield app means manually porting routes, controllers, views, migrations, and the asset pipeline. You would also need to reconcile it with any existing auth customization. Treat it as a reference implementation to copy from rather than a package to install.
- Which PHP, Laravel, Fortify, and Node versions are supported?
- The v0.3.0 release notes do not publish a compatibility matrix covering PHP version, Laravel major, Fortify version, Node/Vite version, or supported databases. This is the biggest blocker to a confident feasibility call before adoption. Ask the maintainer for a supported-versions table and a stated policy for tracking new Laravel majors before you commit a team to the kit.
- What frontend and UI stack does the Aura Starter Kit ship with?
- The kit is wired to Aura UI and ships MIT-licensed Blade components along with Livewire and Tailwind CSS 4. Dark mode works out of the box, and there is a live component overview page you can browse immediately after scaffolding. That means you get a working, styled UI baseline instead of assembling a design system before writing your first feature.
- Does the Aura Starter Kit include two-factor authentication?
- Yes. Version 0.3.0 is the first release with a substantive authenticated-user surface, including a /settings area for profile, password, and two-factor enrollment with a QR code, manual secret, recovery codes, and a confirmation step. Authentication actions are built on Laravel Fortify, with server-rendered settings views layered on top. The 2FA page deliberately re-prompts for the password, which matches Fortify's own endpoint enforcement rather than weakening it.
- How do I enable email verification in the Aura Starter Kit?
- The email verification route is registered but the feature flag is off by default, so a one-line change turns it on. This is a deliberate ergonomic choice: teams can defer the decision without refactoring routes, controllers, or middleware later. Confirm that the disabled state is gated server-side and not only hidden in the UI before relying on it.
- Is the Aura Starter Kit stable enough for production use?
- It is pre-1.0, currently at v0.3.0, which signals an unstable public surface. Expect breaking changes to routes, view names, and the settings layout between minor versions. The release notes also do not state a maintainer roster, governance model, or release cadence for this single-namespace package, which is a bus-factor concern on a security-sensitive area. Pin your scaffolding and plan to diff against upstream releases rather than assuming a smooth upgrade channel.
- Does the Aura Starter Kit support passkeys or WebAuthn?
- No. Fortify ships WebAuthn support, but this kit does not implement the browser ceremony needed for passkeys. The gap is disclosed honestly in the assessment rather than hidden, but it means your team inherits a visible feature gap relative to what Fortify advertises. If passkeys are a requirement, budget for the JavaScript work yourself or evaluate an alternative starter kit.
- How is the Aura Starter Kit tested in CI?
- A GitHub Actions pipeline runs 24 tests and includes an asset build step before testing, which is good practice. Those 24 tests should be read as a signal of intent rather than meaningful coverage of an auth-and-2FA settings area. The notes do not indicate static analysis, linting, or coverage reporting, so plan to add your own test and analysis layers once you fork the scaffold.
- Are the 2FA secrets and recovery codes stored securely?
- The notes do not confirm this, so verify it before shipping. The key questions are whether recovery codes are hashed at rest, single-use, and regenerable, and whether the TOTP secret is encrypted with the application key and confirmed before activation, which is Fortify's default behavior. Also check that password changes invalidate other sessions and remember-me tokens, and that the password re-prompt enforces rate limiting and lockout. Displaying the TOTP secret in plaintext for users who cannot scan is standard, but pair it with an explicit warning in the UI to limit shoulder-surfing and screen-share exposure.