- What is jeffersongoncalves/filament-multifactor-whatsapp?
- It is a Filament 5 plugin for Laravel admin panels that adds WhatsApp one-time-code multi-factor authentication to the Filament sign-in flow. It includes an optional Evolution API connector for sending codes through WhatsApp. Treat it as a thin authentication accelerator rather than a full identity platform.
- How do I install WhatsApp MFA in a Filament 5 Laravel panel?
- Install it with Composer, then configure your Filament panel authentication and the Evolution API endpoint and credentials. You will also need phone-number enrolment and a tested login flow with a dedicated test number. Because public documentation appears thin, verify exact commands, config keys, and migrations by inspecting the package source and README.
- Which Laravel and Filament versions does this package support?
- The package targets Filament 5, and Laravel compatibility is defined by its Composer constraints. Check composer.json for supported PHP, Laravel, and Filament versions before installing. If your application is not on Filament 5, this package is not a practical fit without forking or backporting.
- Does it support the official WhatsApp Cloud API or only Evolution API?
- The provided context describes an optional Evolution API connector, not an official WhatsApp Cloud API integration. Treat the package as Evolution API-oriented unless source inspection shows pluggable drivers. For an official WhatsApp Business API path, expect to build a custom connector or use a provider-supported gateway.
- How are WhatsApp OTP codes stored and secured?
- The provided context does not confirm OTP storage details, so verify this in source before production. Require evidence of hashed OTP storage, short time-to-live, attempt throttling, replay prevention, audit logging, and secure Evolution API credential handling. Do not rely on WhatsApp OTP alone for high-privilege access without those controls.
- Does this package provide recovery codes or fallback MFA factors?
- Recovery-code and fallback-factor support are not confirmed in the provided context. The assessment recommends keeping TOTP, email, or recovery codes as an explicit fallback. If the package lacks fallback support, add it before using WhatsApp as a secondary factor for administrators.
- How are phone numbers enrolled and changed for WhatsApp MFA?
- The context mentions phone-number enrolment as part of integration but does not document the exact workflow. Expect to verify number normalization, country-code handling, initial verification, and an audited change process. Test phone-number changes, account lockout, password reset, and recovery paths alongside normal login.
- Can I enable WhatsApp MFA per Filament panel or user role?
- Per-panel or per-role enablement is listed as a key question rather than a confirmed feature. Inspect the package configuration and source to see whether it supports panel-specific or role-specific activation. For a safe rollout, use a feature flag and limit the pilot to a small privileged admin cohort.
- What are the production risks of using Evolution API for WhatsApp OTP?
- Evolution API is an unofficial WhatsApp bridge, so it carries session, ban, delivery, terms-of-service, and gateway-compromise risks. WhatsApp OTP also inherits SIM-swap and WhatsApp account-takeover exposure. Use it only for a conditional internal-admin pilot with fallback MFA, monitoring, and an official WhatsApp Business API path for regulated or high-privilege access.
- Is this package maintained and tested enough for production?
- The package has low adoption, roughly 17 stars, zero dependents, a low package score, and a single-maintainer pattern, so there is little community safety net. The published last-release date also appears anomalous and should be verified before relying on release cadence. Review tests, security-disclosure process, and maintainer support commitment, and treat it as a conditional pilot rather than sole MFA.