Filament Passkeys Laravel Package

Product Decisions This Supports

• Build vs. buy for passwordless auth: filament-passkeys wraps WebAuthn/passkey support into the Filament panel login flow. For a PM, this is the classic "don't hand-roll a security protocol" decision — the package lets you ship passkeys as a login option without owning credential registration, challenge generation, or attestation verification in-house.
• Roadmap sequencing for auth modernization: Passkeys are usually a retention/security story, not a growth lever. This package makes the "add passkey login to the admin panel" line item cheap enough to slot in as a low-effort hardening task rather than a standalone epic. Prioritize it alongside MFA enforcement, not ahead of core product work.
• Scope containment: It is a Filament-panel-scoped integration, not a general application auth system. Use it to protect internal/admin surfaces first (smaller blast radius, fewer support tickets if UX is rough), then decide whether customer-facing passkeys need a bespoke build.
• v1.4.2 specifically — quality/maintenance signal: The release is a patch with two items: CI adoption of the Happenv package standard (governance/maintenance hygiene) and a fix to start the authentication prompt per challenge rather than per page load. The latter is a correctness fix in the WebAuthn challenge lifecycle — stale or reused challenge state is exactly the class of bug that produces intermittent "passkey login just doesn't work" reports. If you had passkey login enabled on a long-lived SPA-style panel page, this removes a flaky-authentication source. It is not a feature or a breaking change, so it does not change the adoption calculus — but it does support treating the package as actively maintained.
• Upgrade decision: v1.4.2 is a safe patch bump (no deprecations, no API changes advertised). Recommend upgrading on the normal cadence and adding a manual regression check on: repeated login attempts on the same page without a reload, and re-prompt after a cancelled/failed passkey attempt.

When to Consider This Package

Consider it when:

• Your admin or customer portal is built on Filament and you want passkey login without forking the panel's auth flow.
• You want a low-commitment pilot of passkeys — internal users or a beta cohort — before investing in a product-wide passwordless strategy.
• Your team lacks WebAuthn expertise and you'd rather inherit a maintained implementation than own the protocol surface.
• You value a small, actively maintained dependency: the v1.4.2 CI standardization suggests the maintainer is investing in release discipline, which lowers long-term maintenance risk.

Look elsewhere when:

• You need passkeys across non-Filament surfaces (public marketing login, mobile apps, API-based clients) — you'd want a framework-level solution rather than a panel plugin.
• You require enterprise identity features — SCIM, SAML/SSO, conditional access, granular device management — where a dedicated IdP (Okta, Entra, WorkOS) is the right buy.
• You need guaranteed SLAs, vendor support contracts, or a security review with a named counterparty. This is a small-community open-source package; if passkeys become a critical auth path, plan for the possibility of maintaining a fork. Note that v1.4.2's "start the prompt per challenge" fix is precisely the kind of subtle lifecycle bug an in-house team would also have shipped — budget a real QA pass on edge cases rather than assuming the package is turnkey.
• You are pre-product-market-fit and auth is not yet a differentiator; ship passwords + MFA first and revisit.

How to Pitch It (Stakeholders)

For executives (one paragraph): We can offer passkey sign-in on our Filament-based admin/portal in days rather than a multi-week build, using a small open-source plugin that the maintainer is actively keeping current — the latest patch fixed an authentication reliability bug and standardized the release tooling. It reduces password-related support and phishing exposure on our highest-privilege accounts. It is not a platform-wide identity strategy: if passkeys become core to the customer experience or we need SSO/SCIM, we'd graduate to a dedicated identity provider. Recommendation: adopt for internal/admin surfaces now, keep customer-facing passkeys as a separately-scoped decision.

For engineering (one paragraph): happenv-com/filament-passkeys integrates WebAuthn passkeys into Filament's login and profile flows. v1.4.2 is a patch: it fixes prompt initialization to run per challenge instead of once per page load (removes stale-challenge flakiness) and moves CI to the Happenv package standard. No breaking changes — safe to bump. Two asks before we commit: (1) manual regression on repeated and cancelled passkey attempts within a single page session, since that's the area just patched; (2) an explicit note in our dependency review that this is a single-maintainer package, so we know our exit cost if it goes stale.