- What is dasundev/filament-access-secret and what does it do?
- It is a Laravel package that gates access to your Filament admin panel behind a secret key passed in the URL. Visitors without the correct secret cannot reach the panel, so you can hide or stage an admin surface without building roles or custom auth logic. It works as an additive middleware/config layer inside your PanelProvider and requires no database or model changes. Think of it as defense-in-depth via obscurity, not as authentication.
- How do I install filament-access-secret in a Laravel Filament app?
- Install it with composer require dasundev/filament-access-secret, then publish its config file and set the access secret in your .env. Register the plugin or middleware in the PanelProvider of the panel you want to protect. After that, run php artisan config:clear and verify the panel is still reachable with the correct secret. Most developers complete the happy path in well under an hour.
- Which Filament versions (v3 or v4) and Laravel versions are supported?
- Check the package's composer.json constraints and README before installing, because the package has a single maintainer and explicit CI coverage is not clearly documented. Pin an exact version in composer.json and record the Filament constraint it pulls in. Test the spike against your target Filament major in staging before merging, especially if you are on Filament v4 or a recent Laravel release.
- Is URL secret protection a replacement for Filament authentication?
- No. A shared secret in the URL is a gate, not an identity, so it must never replace Filament's native login, policies, or role checks. Keep Filament authentication enabled and compose the two layers, testing that the secret acts as a pre-auth gate rather than a bypass. Use this package for staging environments, internal tools, or pre-launch admin surfaces where you want an extra hurdle.
- Does the secret protect all Filament routes, including the Livewire update endpoint and asset routes?
- Do not assume it does. Filament serves panel routes, asset routes, and relies on the global Livewire update endpoint, so a middleware that only guards the panel root leaves the gate partial. Run php artisan route:list before and after registration and diff the output to see exactly what is covered. Verify Livewire update behavior explicitly in staging before you rely on this package.
- Can I use different access secrets for multiple Filament panels?
- That depends on whether the package supports per-panel configuration or only a single env-driven secret, which you should confirm in the README and config file. In multi-panel applications with separate admin and internal panels, per-panel secrets are often required. If only one global secret is supported, consider applying the middleware selectively to a single PanelProvider instead.
- Will the secret key leak into access logs, browser history, or Referer headers?
- Yes, that is the dominant risk of secret-in-URL designs. Query strings are routinely captured in Nginx and reverse-proxy access logs, CDN and WAF logs, APM traces, browser history, and Referer headers on outbound or third-party requests. Any embed, analytics script, or external link inside the panel can leak the secret. Treat it as a low-value shared secret, rotate it, and apply log redaction guidance.
- Does the package support secret rotation without downtime?
- Rotation support is not clearly documented, so plan for it explicitly. Ideally the config accepts multiple valid secrets so you can add a new one, deploy, update bookmarks, then remove the old value. If only a single secret is supported, rotation requires a coordinated deploy and a config cache clear, so schedule it during a maintenance window.
- Why does the panel still load or suddenly block after running config:cache?
- A cached config with a stale or empty secret is a common failure mode, since the middleware reads the secret from config rather than the environment at runtime. Always run php artisan config:clear locally and php artisan config:cache as part of your deployment pipeline after the env var is set. Confirm the secret exists in the target environment before caching, and check that your panel route gate responds as expected after each deploy.
- Is filament-access-secret safe for production, and how do I roll it back?
- It is reasonable as an extra layer on staging or internal tooling, but it is not a security boundary and the package is a single-maintainer dependency with limited stars and unclear test coverage. Pin the exact version and be prepared to vendor or fork it if maintenance stalls. Rollback is simple: remove the plugin from the PanelProvider and the composer dependency, then deploy, since there are no schema or data migrations to undo.