- How do I replace Laravel’s default auth (e.g., Breeze/Jetstream) with this package?
- Run `php artisan auth:install` to generate the required migrations and config files. Update your `User` model to use the provided traits, then replace any custom auth logic (guards, policies) to align with the package’s contracts. Existing users may need a data migration script to adapt to the new schema.
- Does this package support Laravel 11 or older versions?
- No, it’s built for Laravel 12/13 and requires PHP 8.2+. While it may work with minor tweaks, the maintainer explicitly targets newer Laravel versions for compatibility with features like Reverb and Sanctum’s latest updates.
- Can I use OTP *or* magic links for registration, or must I configure both?
- You can configure either OTP, magic links, or a hybrid approach via `.env` and `config/auth_system.php`. The package defaults to both but allows disabling one flow if your use case doesn’t require it (e.g., OTP-only for high-security apps).
- How does token rotation and refresh work in production?
- The package implements automatic refresh token rotation with reuse detection to prevent token leakage. Tokens expire after a configurable duration (default: 7 days), and clients must include a refresh token in subsequent requests. All tokens are stored in Redis for fast invalidation.
- Will this package conflict with existing Sanctum or Socialite installations?
- It auto-installs Sanctum and Socialite as dependencies, which may cause version conflicts if you’re already using them. Check your `composer.json` for version mismatches and manually override dependencies if needed. The package is designed to work alongside Spatie’s Permissions for role-based access.
- How do I handle real-time verification events (e.g., OTP sent, login success) in my SPA?
- The package uses Laravel Reverb for real-time events. Subscribe to channels like `auth.verification` or `auth.login` in your frontend (e.g., with Laravel Echo). If Reverb isn’t an option, you can poll the API or use webhooks for critical events.
- Is there a way to test the auth flows without sending real emails/SMS?
- Yes, configure a mock mail driver (e.g., `mailgun` or `log`) in `.env` and use the `Auth::fake()` helper in tests. The package includes test utilities to simulate OTP generation, magic links, and token responses without hitting external services.
- What happens if a user requests account deletion? Does the package handle GDPR compliance?
- The package enforces a 30-day grace period before permanent deletion (configurable). During this period, users can restore their account. You’ll need to manually audit the `scheduled_purge_at` field and ensure data is securely wiped after the grace period, as the package doesn’t auto-delete database records.
- Can I integrate Google OAuth alongside password authentication?
- Yes, the package includes built-in Google OAuth via Socialite. Configure your OAuth credentials in `.env` (e.g., `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`), and users can log in via either password or Google. The package merges sessions and tokens seamlessly for both flows.
- What are the risks of using this package in production given it’s still in beta?
- The package is actively tested but lacks long-term production battle-testing. Key risks include undocumented edge cases (e.g., token rotation under high load), configuration errors, or breaking changes in future updates. Start with a staging environment and monitor for issues like failed OTP deliveries or race conditions in session management.