Larapass Laravel Package

Product Decisions This Supports

• Passwordless / passkey authentication roadmap: Larapass gives a Laravel-native implementation of WebAuthn, enabling passkeys, hardware security keys (YubiKey, Titan), and platform authenticators (Touch ID, Windows Hello) without building the attestation/assertion ceremony from scratch.
• Build vs. buy for auth: Strong candidate to buy/build-on rather than build in-house, since WebAuthn involves subtle spec compliance (CBOR parsing, challenge handling, origin/RP ID validation, signature verification) that is easy to get wrong and hard to maintain.
• Step-up and high-assurance flows: Useful for decisions around requiring stronger auth for sensitive actions — admin access, payments, account recovery — where passkeys reduce phishing risk versus TOTP/SMS.
• Reducing auth support and fraud costs: Supports decisions to cut SMS/OTP vendor spend and lower account-takeover exposure; relevant to security/compliance and support-ticket metrics.
• Scope call on multi-device and recovery UX: The package handles credential ceremonies; product still owns registration prompts, device management screens, fallback login paths, and account recovery — budget for that surface area.
• Risk/ops decision for v3.0.2: The release requires a schema change (web_authn_credentials.attestation_type from json to string). If you are on v3.0.0 or v3.0.1, this is a migration task that should be scheduled, not absorbed silently — treat it as an upgrade ticket with a rollback plan.

When to Consider This Package

Adopt when:

• You are on a modern Laravel version and want first-party-style integration (config, migrations,Eloquent models, Blade/JS helpers) rather than wiring a generic PHP WebAuthn library manually.
• You need passkeys as a primary or secondary factor and want the credential lifecycle (registration, attestation storage, assertion verification) managed for you.
• Your team is small and PHP-centric, and maintaining a bespoke WebAuthn implementation is not a defensible use of engineering time.
• You can accept package-level schema ownership — i.e., you are willing to run its migrations and adapt when columns/types change, as in v3.0.2.
• You want a credible reference implementation of the spec that you can extend (custom policies, credential revocation, user-verification requirements).

Look elsewhere when:

• You require enterprise SSO / federated identity as the primary auth strategy — this is a complement, not a replacement for SAML/OIDC.
• You need vendor-supported SLAs or audited certification; this is a community package.
• You cannot run database migrations on the auth tables in a controlled window, or your auth data is managed by an external IdP.
• You need native mobile-first passkey flows across iOS/Android with deep platform integration — the package covers the server side, but you will still own significant client work.
• Your stack is not Laravel or is heavily customized around a non-Eloquent user provider.

How to Pitch It (Stakeholders)

For executives: This package lets us ship passkey/passwordless login on our existing Laravel stack without a research project. It directly reduces phishing and account-takeover risk, and gives us a path to trim SMS/OTP costs. The trade-off is modest: one community-maintained dependency and one database migration.

For engineering: Larapass handles the WebAuthn ceremonies — attestation and assertion — plus credential storage and config, so we avoid writing and auditing cryptography-adjacent code ourselves. The v3.0.2 release is a bug-fix release with one required schema migration: web_authn_credentials.attestation_type must change from json to string for anyone on v3.0.0–v3.0.1. Plan it as a discrete upgrade with a backup and rollback step, verify existing credentials still validate after migration, and add a regression test around registration and login. Remaining gaps we own: registration UX, device/credential management screens, recovery flows, and fallback auth.