Weave Code
Passkeys Laravel Package
laravel/passkeys
Add passwordless WebAuthn/passkey authentication to Laravel. Install migrations, add a trait/contract to your User model, and use the @laravel/passkeys JS client for registration and login. Includes built-in routes for login, confirmation, and passkey management.
Passkeys for Laravel applications
Frequently asked questions about Passkeys
- How do I add passkey authentication to an existing Laravel app?
- Install via Composer (`composer require laravel/passkeys`), publish migrations (`php artisan vendor:publish --tag=passkeys-migrations`), run migrations, and add the `PasskeyAuthenticatable` trait to your User model. The package handles routes, middleware, and WebAuthn complexity automatically.
- Does this package support Laravel 10+ and PHP 8.1+?
- Yes, Laravel Passkeys is optimized for Laravel 9+ and 10+ with PHP 8.1+. It requires OpenSSL and libsodium for cryptographic operations. Check the [GitHub repo](https://github.com/laravel/passkeys-server) for version-specific notes.
- Can I use custom User or Passkey models instead of the defaults?
- Absolutely. Override the default models in a service provider using `Passkeys::useUserModel()` and `Passkeys::usePasskeyModel()`. The package supports custom schemas while maintaining full functionality.
- What browsers/devices support passkeys, and how do I handle unsupported ones?
- Passkeys require Chrome 89+, Safari 15.4+, iOS 15.5+, or Android 9+. Use `navigator.credentials` feature detection to redirect unsupported users to password login or prompt for device upgrades. The package includes graceful fallback logic.
- How do I customize the passkey registration/verification UI in the frontend?
- Use the `@laravel/passkeys` npm package for pre-built JS methods like `Passkeys.register()` and `Passkeys.verify()`. Override `getPasskeyDisplayName()` or `getPasskeyUsername()` in your User model to customize how names appear in the authenticator UI.
- Are the passkey routes automatically registered, and can I disable them?
- Yes, routes like `/passkeys/login/options` are auto-registered. Disable them via `Passkeys::ignoreRoutes()` in a service provider. You can also replace them entirely by binding custom controllers to the routes.
- How secure is the passkey storage, and do I need to manage cryptographic keys?
- The package uses WebAuthn’s opaque handles and relies on PHP’s `webauthn/php-authenticator` for cryptographic operations. Ensure `PASSKEYS_USER_HANDLE_SECRET` has high entropy. No manual key management is required beyond standard Laravel security practices.
- Can I use passkeys alongside existing password authentication?
- Yes, passkeys coexist seamlessly with password auth. The package integrates with Laravel’s guards and middleware. Users can log in via passkeys or passwords, and you can enforce passkeys for specific routes or user roles.
- What events are emitted for auditing or analytics?
- The package emits `PasskeyRegistered`, `PasskeyVerified`, and `PasskeyDeleted` events. Listen to these in your `EventServiceProvider` to log actions, trigger notifications, or integrate with third-party tools like analytics or SIEM systems.
- Are there alternatives to Laravel Passkeys for WebAuthn in Laravel?
- Other options include `league/webauthn` (lower-level) or `paragonie/webauthn` (more manual setup). Laravel Passkeys stands out by offering Laravel-native integration (migrations, contracts, routes) and a paired JS client, reducing boilerplate significantly.
Weaver
How can I help you explore Laravel packages today?