Mfakitv4 Laravel Package

Product Decisions This Supports

• Build vs. buy for MFA. The primary decision this package informs is whether to hand-roll TOTP, email OTP, and WhatsApp OTP flows or start from a working reference. It shifts the conversation from "can we build MFA?" to "can we own and harden MFA?" — a materially smaller scope.
• Feature: MFA on the admin surface. Filament is typically the back office: internal ops, support tooling, tenant administration. Enabling MFA there is one of the highest-leverage security features per engineering hour, and this kit makes it a configuration exercise rather than a project.
• Roadmap: compliance milestones. MFA is an explicit control in SOC 2 (CC6.x), ISO 27001 (A.5.17 / A.8.5), HIPAA, and GDPR Art. 32. A working implementation shortens audit preparation and answers security questionnaires with "shipped," not "planned."
• Roadmap: enterprise readiness / sales unblock. "Does your product support MFA?" is a standard gate in B2B procurement. This package is a way to close that gate before it costs a deal cycle.
• Channel decision: WhatsApp as an OTP channel. For LATAM, EMEA, and APAC markets, WhatsApp OTP can be cheaper and more reliable than SMS. Its presence here is a differentiator worth evaluating against Twilio/Vonage SMS spend — but it carries a third-party dependency (Meta Business API) that must be assessed separately.
• Architecture commitment. Adopting this is implicitly a bet on Laravel 13.x + Filament 4.x. That's a fine bet for a greenfield product; it is a poor bet as a retrofit.
• Use cases well suited: greenfield Laravel SaaS with a Filament admin, internal ops consoles, customer portals needing step-up auth, and prototypes where security posture must look credible early.

When to Consider This Package

Consider it when:

• You are greenfield or early-stage on Laravel 13.x and Filament 4.x and have not yet built auth flows.
• You need MFA in days, not sprints, and do not have a dedicated security engineer.
• Your MFA-exposed surface is the Filament admin panel — the kit is built for exactly that shape.
• WhatsApp OTP is a genuine requirement for your target markets, not a novelty.
• You are comfortable treating it as a starter kit to fork and own (MIT license), not a dependency you consume via Composer and expect upstream fixes for.

Look elsewhere when:

• You are not on Filament 4 / Laravel 13 — the retrofit cost likely exceeds building directly on Laravel Fortify.
• You need enterprise identity: SAML/OIDC SSO, SCIM provisioning, passkeys/WebAuthn, hardware security keys. Evaluate WorkOS, Auth0, Keycloak, or Fortify plus vetted community packages instead.
• You require a vendor-backed SLA, coordinated security disclosures, CVE response, or long-term support. Ten stars and a single maintainer is a bus-factor signal — this is a starting point, not a supply-chain dependency.
• You are in a regulated environment that requires a certified product rather than audited-by-you source code.
• Your MFA needs go beyond starter scope: multi-tenant policy per organization, adaptive/risk-based step-up, recovery-code lifecycle, device trust, audit trails.
• Your team cannot absorb maintenance of the auth path. Auth is code you must be able to debug at 2 a.m.

How to Pitch It (Stakeholders)

To executives: This is an MIT-licensed starter kit that ships working multi-factor authentication — authenticator apps, email codes, and WhatsApp codes — on top of Laravel and Filament, the stack our admin tooling already uses. It is not a paid product and not a vendor contract; it is a head start. The business case is speed and risk: MFA in days instead of a sprint or two, which directly unblocks enterprise security questionnaires and supports our SOC 2 / ISO 27001 readiness story. Two caveats to budget for: we own the code once we fork it, and the project is young (small community, single maintainer), so it needs an internal security review and version pinning before production. Recommendation: fund a short spike to fork, review, and validate it, then decide on production adoption — do not adopt it unreviewed as a dependency.

To engineering: Treat it as a reference implementation of TOTP, email, and WhatsApp OTP flows with Filament-native UI, not as an installed library. Fork it, pin Laravel and Filament versions, review the OTP generation, rate limiting, replay protection, secret storage, and recovery paths line by line — those are the parts that matter and the parts a starter kit is least likely to get fully right. Plan for WebAuthn/passkeys as a follow-on if enterprise buyers ask. The WhatsApp channel adds an external dependency on the Meta Business API; scope that separately from the TOTP and email paths, which carry no vendor risk.