- How do I install bmatovu/multi-auth in a Laravel application?
- Install the package with Composer, then publish its config, migrations, routes, and views as documented. Configure guards and providers in config/auth.php, define the related Eloquent models, and seed an initial admin or secondary user. Validate the package Composer constraints against your target Laravel and PHP versions before integrating it into an existing app.
- Which Laravel and PHP versions does bmatovu/multi-auth support?
- Check the package composer.json constraints for the definitive Laravel and PHP version support. The last release noted in the evaluation is from April 2024, so do not assume compatibility with newer Laravel majors. Test against your exact framework, PHP, database, session, and view stack before adopting it.
- Can bmatovu/multi-auth coexist with an existing Laravel User table and role package?
- It may be possible to add a secondary guard and model while keeping your existing User guard, but brownfield integration is materially harder. You need to preserve existing users, password brokers, verification flows, remember-me tokens, and authorization rules. Avoid replacing your current auth guard in place, and test coexistence with any role or permission package carefully.
- Is bmatovu/multi-auth a runtime dependency or just authentication scaffolding?
- Confirm whether the package is scaffolding-only or a runtime dependency, because that distinction changes upgrade burden and exit cost. If it is scaffolding-oriented, a common approach is to copy the generated patterns into application code and remove the package dependency after stabilization. Review what the package publishes and whether your app will call its code at runtime.
- Does bmatovu/multi-auth work with Laravel Sanctum or Passport for API authentication?
- The package is described as a fit for session-based Laravel monoliths using native guards and providers. It is a weaker fit for API-first or SPA architectures that rely on Sanctum or Passport, SSO, OIDC, or centralized identity. Verify whether it supports token guards if your application needs API authentication rather than browser session guards.
- How do I create separate admin and customer login routes with multi-auth?
- Configure separate guards, providers, and user models for each actor type, then organize routes and middleware around those guards. Publish the package routes and views, and test login, logout, redirects, and access boundaries per guard. For lower risk, implement the secondary non-admin guard first and validate it before exposing admin authentication.
- What security risks should I consider before using multi-auth in production?
- Authentication is security-critical, so guard misconfiguration, privilege escalation across actor types, broken password reset or verification routing, and conflicts with existing auth scaffolding are the main concerns. The package has low ecosystem validation signals, including few dependents and one apparent maintainer, so treat it as low-validation code. Run a threat model, test route and middleware boundaries, roll out behind a feature flag, and keep a rollback plan.
- Does bmatovu/multi-auth support password reset, email verification, remember-me, and rate limiting?
- Do not assume support for these native Laravel auth features without verification. The evaluation recommends testing email verification, password reset, remember-me, logout across guards, and redirect behavior per guard. Check the published config, routes, notifications, and password broker setup against your application requirements.
- Can I use bmatovu/multi-auth alongside Breeze, Jetstream, Fortify, or Laravel UI?
- Avoid stacking another auth scaffold on top of Breeze, Jetstream, Fortify, or Laravel UI without a clear reason. If you already use one of those tools, use multi-auth selectively or copy its patterns for a new actor type instead of replacing your current auth flow. Brownfield integration requires preserving existing middleware aliases, route names, password brokers, and notification classes.
- Is bmatovu/multi-auth actively maintained, and what is the upgrade path?
- The evaluation notes 180 stars, zero Packagist dependents, one apparent maintainer, a last release date of 2024-04-23, and a low opportunity score. Treat the package as a time-saving reference implementation rather than a strategic platform dependency, and confirm the license and maintenance posture. For Laravel major upgrades, validate Composer constraints in a disposable app, test all guard boundaries, and plan an exit or rollback path.