- What does jeffersongoncalves/filament-multifactor-passkeys do?
- It is a thin Filament 5 plugin that adds WebAuthn passkey multi-factor authentication to Filament panels. It provides the Filament glue: plugin registration, publishable config and views, translations, a login-flow hook for the MFA challenge, and a profile UI for registering and deleting passkeys. The security-critical WebAuthn ceremonies, credential storage, challenge generation, and assertion verification are delegated to spatie/laravel-passkeys.
- Which Laravel, PHP, and Filament versions does this package support?
- The package targets Filament 5, Laravel 11 and 12, and PHP 8.2 or newer. If your admin panel is on Filament 3 or 4, or your app uses a non-Filament Livewire or Inertia frontend, this package is out of scope. Check the Composer constraints before adopting it.
- How do I install and register the passkey MFA plugin in a Filament 5 panel?
- Install it with Composer, register the plugin in your Filament panel provider, run the migrations, and publish the config and views. You then set the WebAuthn relying-party ID and origin so they match the panel URL and APP_URL. The package mechanics are nominally a same-day task, but TLS and origin configuration are the real deployment work.
- How do I configure the WebAuthn relying party ID and origin for passkeys?
- Set the relying-party ID and origin to the exact origin of the Filament panel, and make sure APP_URL matches. Every non-local environment needs valid TLS, while local development requires localhost or a tunnel with a matching origin. If admin and app live on different subdomains, decide explicitly whether to use one shared RP ID or per-panel configuration, because this is a common first-day failure mode.
- Is this package for passkey MFA or passwordless login?
- The package is advertised as additive multi-factor authentication, meaning a passkey is a second factor alongside the password. The underlying Spatie package and WebAuthn ceremonies are also the foundation for passwordless login, but this plugin's target is the safer additive MFA flow. Scope the rollout carefully, because adding a second factor and replacing the password are very different product changes.
- How do users enroll a passkey before passkey MFA can work?
- A user must register a passkey before any passkey-based challenge can succeed, so the feature is useless until enrollment is broad. You need to prompt enrollment through a UI nudge, an admin mandate, or an onboarding step. Treat this as a product sequencing problem to plan before installation, not as an engineering afterthought.
- Does this package implement the WebAuthn cryptography itself?
- No, it delegates the security-critical work to spatie/laravel-passkeys, including registration ceremonies, credential storage, challenge generation, and assertion signature verification. This repository contributes the Filament service provider, plugin contract registration, publishable config and views, translations, login-flow hook, and per-user passkey profile UI. That division keeps the audit surface small, but you should still pin and review the upstream Spatie dependency.
- How do I test passkey authentication locally in Laravel?
- Use localhost or a tunnel whose origin matches the configured relying-party ID and origin, and keep APP_URL consistent. Non-local environments require valid TLS with an RP ID scoped to the exact origin. Pay special attention to enrollment, user-verification, fallback, and recovery paths, because WebAuthn defects often appear as silent lockouts or enrollment failures rather than clear exceptions. Test the subdomain topology you plan to deploy.
- Is this package production-ready, and what are the maintenance risks?
- The dominant risk is that the package has a bus factor of one, zero dependents, and very little third-party production validation, with no published threat model or named security contact. It also sits at the leading edge of Filament 5 and a recent Spatie dependency, so a Filament 6 major release could strand it until the author ships an update. Mitigate by pinning exact versions and being prepared to own a fork. Recent releases show healthy i18n and CI hygiene, but do not assume product depth such as admin-side credential revocation or audit logging; validate those requirements separately.
- Can I use spatie/laravel-passkeys without this Filament plugin, or what are the alternatives?
- Yes, spatie/laravel-passkeys can be integrated directly if you are willing to build the Filament login hook and passkey management UI yourself. This package is essentially the Filament 5 glue layer for that upstream library. If you are on Filament 3 or 4, or use a non-Filament frontend, this plugin is out of scope, so evaluate direct Spatie integration or another MFA approach for your stack.