Weave Code
Fortify Laravel Package
laravel/fortify
Laravel Fortify is a frontend-agnostic authentication backend for Laravel, powering registration, login, password reset, and two-factor authentication for Laravel starter kits and your own custom UI.
Backend controllers and scaffolding for Laravel authentication.
Frequently asked questions about Fortify
- What is Laravel Fortify used for?
- Laravel Fortify is a first-party, frontend-agnostic authentication backend. It provides routes, controllers, actions, and a configurable feature pipeline for registration, login, password reset, email verification, password confirmation, and two-factor authentication. Use it when you want Laravel's authentication behavior without committing to a specific UI.
- How do I install Laravel Fortify in a Laravel app?
- Install it with composer require laravel/fortify, then publish Fortify's configuration and service provider wiring and run the necessary migrations. Add the two_factor_secret, two_factor_recovery_codes, and two_factor_confirmed_at columns to your users table if you enable 2FA. Review config/fortify.php to turn features on or off and point Fortify at your login, registration, and challenge views or JSON responses.
- Does Laravel Fortify include UI views or Blade templates?
- No. Fortify deliberately ships no UI, views, or frontend scaffolding; it is the backend authentication kernel. You provide Blade, Livewire, React, Vue, mobile, or other frontend screens and wire them to Fortify's routes and response contracts.
- Which Laravel and PHP versions does Laravel Fortify support?
- Fortify tracks new Laravel majors quickly. The 1.37 line requires PHP 8.2+ and dropped Laravel 10, and Laravel 13 support arrived in 1.34.1. For current projects, target Laravel 11, 12, or 13 on PHP 8.2+ and pin a tested Fortify version.
- How do I enable and configure two-factor authentication in Fortify?
- Enable Features::twoFactorAuthentication in config/fortify.php, add the required 2FA columns to users, and implement the challenge and confirmation views or JSON responses. Fortify handles TOTP secrets and recovery codes, with passkey support added in the 1.37 line. Because 2FA state handling, recovery codes, and passkeys have seen recent churn, add regression tests and review changelogs before upgrading.
- Can I use Laravel Fortify with an SPA using Sanctum?
- Yes, Fortify can back a Sanctum SPA by returning JSON responses from its response contracts while Sanctum manages cookie-based session auth or API tokens. The recurring pitfalls are session and CSRF semantics in SPA mode, so test login, logout, 2FA challenge, and password confirmation end to end. Fortify does not replace Sanctum for API token issuance; it covers first-party session and guard authentication.
- How do I customize Fortify routes, features, and authentication responses?
- Start with config/fortify.php to toggle features, guards, usernames, and route behavior, and customize views via Fortify::loginView, Fortify::registerView, and similar callbacks. Override response contracts or action classes when you need custom JSON, redirects, or identity policy. Prefer configuration-first changes and subclass or replace only the actions you truly need.
- How should I test Fortify authentication flows in Laravel?
- Use Laravel's HTTP testing helpers to hit Fortify's routes and assert authentication, validation, redirects, and JSON responses. Cover each enabled feature, plus 2FA challenge, recovery-code, passkey, rate-limit, and password-confirmation paths where applicable. Because Fortify is pipeline and container heavy, test behavior through routes rather than only unit-testing isolated action classes.
- What production concerns should I review before using Fortify?
- Auth is security critical, and Fortify's behavior lives in pipelines and container-resolved actions, so your team should read the source and pin versions while reviewing changelogs. Define rate limiting, lockout, session revocation, audit logging, breach notification, and 2FA secret encryption via encryptUsing or Model::encryptUsing. Plan for email deliverability on verification and reset flows, and decide now whether SSO, SAML, OIDC, or SCIM requirements mean Fortify must be paired with an IdP integration.
- Is Laravel Fortify actively maintained, and how does it compare with Breeze or Jetstream?
- Yes. Fortify is first-party and actively shipped, with version cadence that tracks Laravel majors quickly, so pin it and review upgrade notes. Breeze and Jetstream are starter kits that add UI scaffolding, while Fortify is the frontend-agnostic backend used by Laravel starter kits. Choose Fortify when you want Laravel's auth behavior with your own UI, choose a starter kit for faster views, and add an enterprise IdP integration if federated identity is a primary requirement.
Weaver
How can I help you explore Laravel packages today?