- How do I install m1guelpf/laravel-web3-login?
- Install it with Composer using composer require m1guelpf/laravel-web3-login, then publish any package assets or migrations your app needs and add a wallet address column to your users table. You also need a frontend that can request a signature from the user's wallet and post it to a verification endpoint. Check the README for the exact publish tags and route setup for your version.
- Does laravel-web3-login support registering new users with an Ethereum wallet?
- Yes. Version 1.1.0 added user registration via wallet address, whereas 1.0.x only authenticated against an existing user record. After the signature is verified, the package persists a new User row keyed on the wallet address, which makes it viable for greenfield dApps, NFT-gated products, and token-holder portals.
- Which Laravel and PHP versions does m1guelpf/laravel-web3-login support?
- The package is built for modern Laravel releases and slots into the native auth guard and session model, but exact Composer constraints should be checked against the repository's composer.json before you commit. Confirm the Laravel and PHP versions you run are still supported, and pin the signature-verification dependencies so they resolve cleanly on your PHP version.
- How does the package verify Ethereum signatures server-side in Laravel?
- A JS client such as ethers.js asks the wallet to sign a challenge message, and the signed payload is posted to a PHP endpoint where the package verifies it server-side. Verification typically relies on elliptic-curve and keccak PHP libraries, which are external security-critical dependencies you should pin and audit. On success the user is authenticated through Laravel's normal guard and session.
- Is wallet login with laravel-web3-login safe from replay attacks?
- Replay protection depends on correct nonce issuance, single-use enforcement, and expiry, which are application responsibilities around the package's verification step. A registration flow without a robust nonce table is an account-takeover vector via replayed signatures. Also confirm that the signed message includes a chain ID and follows EIP-4361 formatting so a signature from one chain cannot be replayed on another.
- Can I link a wallet to an existing Laravel user instead of creating a new account?
- The package's registration path is focused on greenfield accounts keyed on wallet address. Whether an account-linking flow exists for attaching a wallet to an existing email/password user is a key question to confirm in the code or README. Many teams implement linking as an application-level step that calls the same signature verification before storing the address on the authenticated user.
- What frontend do I need for Web3 login in Laravel?
- You need JavaScript capable of prompting a wallet signature, typically ethers.js or web3.js, plus a wallet such as MetaMask. The backend is only half the integration; backend-only teams will need JS collaboration to capture and submit the signed challenge. The PHP side then verifies the signature and authenticates the user.
- Does laravel-web3-login support multiple EVM chains or just Ethereum mainnet?
- Multi-chain scope is one of the open questions for this package, so check the source for whether verification is bound to a specific chain ID. If the signed message does not include chain ID, a signature valid on one chain could be replayed on another. Treat EVM-compatible chain support as something to validate rather than assume.
- How do I test Web3 authentication flows in a Laravel app?
- Test the nonce lifecycle and signature verification directly, covering valid signatures, expired challenges, and replayed payloads. You can generate signed messages in tests with a known private key using a JS or PHP Ethereum library, then assert the endpoint authenticates only once per nonce. Keep the security-critical paths under coverage, since signature verification is a dependency outside the maintainer's control.
- What are the alternatives to m1guelpf/laravel-web3-login?
- Alternatives include Sign-In with Ethereum libraries and broader Web3 auth providers, or rolling your own nonce plus signature verification with ethers.js and a PHP EC library. The package's main advantage is fitting Laravel's native auth guard and session model instead of a custom pipeline. Weigh that against its single-maintainer bus factor and small contributor base before adopting it for authentication.