Google Authenticator Bundle Laravel Package

Product Decisions This Supports

• MFA roadmap scoping and sequencing. Whether "authenticator app (TOTP)" ships as a standalone capability, anchors a broader MFA program (SMS, email OTP, passkeys/WebAuthn), or is deferred behind higher-value work. The package covers only the TOTP factor — it informs the shape of the MFA roadmap, not the whole of it.
• Build vs. buy for a commodity security primitive. TOTP is RFC 6238: well-understood, low-differentiation, and a poor use of engineering time to hand-roll. This is a candidate "buy" (MIT, free) for the three primitives it actually provides — secret generation, otpauth:// provisioning URIs, and time-window code verification.
• Compliance and enterprise-sales gating. Security questionnaires and frameworks (SOC 2, ISO 27001, cyber-insurance renewals, procurement reviews) routinely require MFA. Adding a TOTP factor is often the cheapest way to clear a checkpoint — a concrete revenue unlock rather than a purely technical decision.
• Prioritization across factor alternatives. Compare authenticator-app TOTP against SMS OTP (carrier cost, SIM-swap risk, deliverability) and passkeys (higher UX bar, more build effort) on cost, risk reduction, and time-to-ship.
• Risk acceptance as a dependency decision. The adoption signals here — 4 stars, 0 dependents, near-zero visible maintenance — are themselves product input. They argue for treating any extracted code as vendored source you own, not a supported dependency with an implied SLA.

When to Consider This Package

Consider it when:

• You are on Symfony — this is a Symfony bundle (bundle class, DI extension, config tree), not a Laravel package. It is only usable where a Symfony kernel registers it. In that context it is a small, MIT-licensed wrapper to get TOTP enrollment and verification without writing crypto yourself.
• You need a fast, low-cost second factor for an internal tool, admin back office, or MVP where the security bar is "materially better than passwords alone" and the UX bar is "scan a QR code."
• You will wrap it behind your own interface (e.g., a TwoFactorProvider / TotpService abstraction) so the implementation is replaceable and product code never depends on the bundle directly.

Look elsewhere when:

• You are building on Laravel. There is no supported path to composer require a Symfony bundle into Laravel and have it function; the bundle wiring is inert. Use the first-party path (Fortify/Jetstream TOTP) or a maintained Laravel-native 2FA package (pragmarx/google2fa-laravel) or the underlying OTP core (spomky-labs/otphp). Treat this project, at most, as a reference implementation for the TOTP flow.
• You need passkeys/WebAuthn, push, or SMS in the same factor set — this covers TOTP only.
• You require active maintenance, security advisories, or vendor support. With near-zero community validation and dependents, assume you are the maintainer. Plan for a pinned version, private fork, or vendoring.
• Your threat model demands phishing-resistant MFA (regulated, high-value accounts). TOTP is phishable; it is not the right long-term factor for those users.
• The surrounding product surface — recovery codes, rate limiting, replay protection, encrypted secret storage — is not already solved elsewhere in your stack. This package does not provide it.

How to Pitch It (Stakeholders)

To executives: MFA is now table stakes in security questionnaires and a recurring blocker in enterprise procurement. This is a free, MIT-licensed TOTP implementation that can put an authenticator-app factor into the product quickly at near-zero license cost. The strategic value is unlocking deals and compliance checkpoints, not technical differentiation — so scope it as a small, time-boxed security milestone. Two caveats to set expectations: the upstream project shows minimal community activity, so we should budget a modest engineering reserve to own the code we rely on; and because it is Symfony-specific, it is only directly usable in a Symfony service — if we are on Laravel, we take the Laravel-native path instead and treat this as a reference only.

To engineering: It is a thin bundle around a TOTP library — secret generation, otpauth:// provisioning URI, code verification. Small surface area, clean MIT license, but effectively unmaintained and framework-coupled to Symfony. Two conditions for any reuse: (1) isolate it behind our own TotpService interface so it stays replaceable, and (2) assume we own it — vendor or fork the underlying class, pin the version, and add our own tests around clock skew, replay, rate limiting, and secret storage. If we are on Laravel, do not attempt to install the bundle; standardize on pragmarx/google2fa-laravel and close the evaluation with a documented rationale so it is not re-proposed.