- How do I install exodusanto/administrator in a Laravel application?
- Install it with Composer (composer require exodusanto/administrator), then publish its config file and frontend assets and register the Eloquent models and field types you want exposed. You also need to wire up an auth guard and route middleware so the generated admin routes are protected. Time-to-demo is short, measured in hours, but run the whole flow on a throwaway branch against your exact Laravel and PHP versions before committing.
- Which Laravel and PHP versions does Laravel-Admin support?
- Version constraints are not clearly documented, so read composer.json in the repository and check exactly which Laravel and PHP ranges it permits. Then run the package against your lockfile versions and confirm it installs, boots, renders, and saves without source edits. Treat version support as unproven until you have tested it yourself, since there is no downstream usage to validate it.
- Does Administrator work with Inertia, Livewire, or an SPA frontend?
- No. It is a server-rendered, Blade-based, config-driven CRUD scaffolding package that ships its own views, routes, and bundled frontend assets, so it does not compose with Inertia, Livewire, or a separate SPA frontend. It also sits outside your existing design system, meaning its UI is its own and not yours. It fits conventional Laravel monoliths used for internal back-office tooling.
- How does Laravel-Admin handle authentication and authorization?
- The package supplies the admin routes, views, and CRUD logic, but you are responsible for wiring an auth guard and route middleware around them. Whether it uses Laravel's native gates and policies or its own permission model is not documented, so inspect the source before trusting it with a privileged admin surface. An admin panel is a high-value attack surface, so verify authorization on every model and action yourself.
- What security issues should I check before putting this admin panel in production?
- You inherit the package's authorization model, mass-assignment handling, file-upload path, and whatever JavaScript it ships, so audit each of those deliberately. Check whether frontend assets are vendored, prebuilt, or pulled from a CDN, and review their versions for known CVEs. Restrict access by role and network, verify CSRF protection is active on all write routes, and test for mass-assignment and upload escapes before exposing real data.
- Is exodusanto/administrator actively maintained and safe to depend on?
- The signals are thin: roughly 39 stars, a single maintainer, zero dependents, low composite and opportunity scores, and a lineage from Frozennode Laravel-Administrator, which has been effectively unmaintained for years. There is no downstream production usage to validate it and no ecosystem pressure to keep it tracking Laravel majors. Budget for fork ownership and assign a named owner, because unowned internal admin tools rot fastest.
- How does Laravel-Admin compare to Filament, Nova, or Backpack?
- It is a continuation of the older Frozennode Laravel-Administrator and occupies a similar config-file-driven CRUD niche, but with a far smaller ecosystem than Filament, Nova, or Backpack. Choose it for low-risk greenfield internal tooling where nothing needs to be unseated, or for bounded coexistence in one domain behind its own route group. Do not port a mature, business-critical admin onto it, because migration cost exceeds the maintenance savings.
- Does Administrator provide a headless API or JSON mode?
- No. There is no headless or API mode, so the package competes with your application's own routing rather than composing with it. It is built to render Blade admin screens for humans, not to expose resources to a frontend or external service. If you need a decoupled admin or API-first architecture, this package is the wrong fit.
- What is the upgrade story across Laravel major versions?
- There is no documented upgrade path, so assume you will read the source and patch as needed when a new Laravel major lands. Verify that published config and assets survive the framework upgrade and that nothing collides with your auth guard, global middleware, or route model binding conventions. Plan on days per major upgrade at minimum, and weeks if the package reaches into Laravel internals that changed.
- Are there automated tests, and do they cover authorization and permissions?
- Automated test coverage is not evident from the available information, and there is no indication that authorization or permission behaviour is tested. That means you must write your own feature tests for access control, mass assignment, and file uploads against your configured models. If the package requires source edits just to install or boot, stop and reconsider rather than adopting a fork you now own.