- How do I install Larapass in a Laravel application?
- Install it with Composer using darkghosthunter/larapass, then publish the package config and migrations and run php artisan migrate. Add the package trait to your authenticatable model and expose the registration and login ceremony endpoints the package ships with. The service provider registers a WebAuthn facade, routes, and events so you do not have to hand-roll challenge generation or signature verification.
- Which Laravel and PHP versions does Larapass 3.x support?
- The 3.x line targets modern Laravel releases and PHP 8.x, but the authoritative answer is the constraint block in the package composer.json and its Packagist metadata. Check that window against your app before upgrading, since a Laravel major bump often forces a package major bump too. Pin to the range you have actually tested rather than floating on dev-master.
- What changed in Larapass v3.0.2 and do I need to run a new migration?
- v3.0.2 is a maintenance patch that fixes the web_authn_credentials.attestation_type column so it is stored as a string rather than JSON. If you installed v3.0.0 or v3.0.1 and ran their migrations, your database has the old column type and you need an explicit migration to alter it. Treat this as a schema migration even though it shipped under a patch version.
- How do I fix the attestation_type column if I already migrated on v3.0.0 or v3.0.1?
- Write a migration that alters web_authn_credentials.attestation_type to a string type and backfills any rows currently stored as JSON-encoded values. Test on a staging copy first, and verify by completing a real credential registration, because the failure mode is a write-time error during enrollment rather than a login failure. Existing users will not notice anything until a new passkey is created, so do not rely on login smoke tests alone.
- How do I add passkey support to my User model with Larapass?
- Your authenticatable model implements the package's HasWebAuthn-style trait and contract, which links it to the Eloquent-backed credential repository. Credentials live in the shipped web_authn_credentials model, and the package fires events during registration and assertion so you can hook logging or notifications. This generally coexists with an existing 2FA package as long as both do not claim the same routes, guards, or session keys, so review your route registration before enabling it.
- What JavaScript do I need on the frontend to use Larapass?
- Larapass handles the server-side WebAuthn ceremony but assumes the browser calls navigator.credentials.create and navigator.credentials.get. You need to base64url-encode the challenge and credential IDs coming from your endpoints, decode the responses before POSTing them back, and build UX that handles both platform authenticators like Touch ID and roaming security keys. Budget more time for this layer than for the backend integration, which is typically days.
- How do I test passkey registration and login in Laravel?
- A real ceremony needs a browser WebAuthn API, so plain HTTP feature tests cannot exercise it end to end. Unit-test the server-side verification with captured credential fixtures, and drive the full flow with a browser automation tool using a virtual authenticator, which Chrome exposes through the DevTools protocol. Always include the enrollment path in your tests, since registration is where schema mismatches surface.
- Is attestation required, and which attestation conveyance should I use with Larapass?
- Attestation conveys device provenance and is a product and compliance decision as much as a technical one. Most consumer flows deliberately request no attestation, while some regulated contexts require it to prove which authenticator was used. Whatever you choose must match the semantics of the attestation_type value you persist, so decide the policy before shipping rather than retrofitting it.
- What happens if a user loses their device, and does Larapass handle account recovery?
- Larapass does not solve account recovery, because a passkey is one factor and a lost authenticator becomes a lockout if nothing else exists. You must design and document a fallback such as a password, an email magic link, or recovery codes, and encourage users to enroll more than one device. Treat the recovery flow as a first-class requirement, not an edge case.
- Is darkghosthunter/larapass safe to use in production?
- The package has a single primary maintainer supported by community pull requests, which is acceptable for its maturity level but means you should track releases and CVE responsiveness deliberately. Because it sits directly in your authentication path, pin a tested version, review the diff before upgrading, and verify published config against the vendor default after each release. Also confirm that patch releases do not quietly change schema expectations, as v3.0.2 did.