Weave Code
Laravel Magic Login Laravel Package
maize-tech/laravel-magic-login
Laravel Magic Login adds passwordless authentication to your Laravel app using temporary signed magic links sent by email. Users log in with one click, no password required, with configurable expiry and easy customization.
Easily add passwordless authentication into your application
Frequently asked questions about Laravel Magic Login
- How do I install and use maize-tech/laravel-magic-login in a Laravel app?
- Install the package with Composer, publish its configuration, and apply the MagicLogin trait to your authenticatable model. The package then sends temporary signed links by email so users can log in with one click. Check the README for your pinned version and confirm whether that release requires any migrations before rolling it out.
- Which Laravel and PHP versions does laravel-magic-login support?
- Release 2.4.0 adds Laravel 13 support, but the release notes do not clearly settle whether older illuminate/* constraints are widened or replaced. Verify Laravel 10, 11, and 12 compatibility by resolving the package in staging rather than assuming the minor bump preserves all older bounds. The minimum PHP version depends on your Laravel version, especially Laravel 13, so pin explicitly and check it against your fleet floor.
- How do I configure magic link expiry?
- Expiry is configurable through the package configuration after you publish it. The technical assessment recommends tuning the signed URL TTL per route and user cohort instead of relying blindly on a default. Verify the default TTL and any changes between 2.3.0 and 2.4.0 before upgrading.
- Are magic login links single-use and revocable?
- The package uses temporary signed URLs, but the assessment flags single-use consumption and revocation as items to verify rather than assume. Review the token lifecycle code and add enforcement if your threat model requires one-time links or invalidation on password or email change. Expiry alone is not the same as revocation.
- How do I customize the magic login email or notification channel?
- The package integrates with Laravel notifications, so you can customize the notification class and choose mail, SMS, Slack, or another channel supported by your app. Review the published configuration and notification code to change copy, routing, or delivery behavior. Keep delivery failures and rate limiting in mind for production use.
- Can I use magic login alongside existing password or SSO authentication?
- Yes. The package extends Laravel auth primitives and is designed to be additive, so you can expose a single opt-in route or gate it per user cohort while leaving password and SSO paths untouched. Rollback is typically config and route removal, but confirm whether your pinned release ships migrations that affect rollback.
- Is laravel-magic-login safe for production customer-facing accounts?
- Use it for internal admin tools, low-friction onboarding, or as a step-up or fallback auth path, not as a replacement for MFA-protected primary auth on customer-facing accounts without extra controls. The assessment calls for device binding, single-use enforcement, rate limiting, audit logging, and invalidation on password or email change. Also review maintainer concentration and the lack of evidence for a third-party security audit.
- How do I test magic login routes in Laravel?
- Treat magic login like any Laravel auth route: feature-test link generation, expiry, invalid signatures, and token consumption behavior. Run the package's own test suite against your framework version and ensure existing auth tests still pass. The assessment recommends a staging build and an internal pilot with audit logging before wider rollout.
- What changed in laravel-magic-login 2.4.0 and should I upgrade?
- Version 2.4.0 is a maintenance release with three Dependabot bumps to GitHub Actions and Laravel 13 support, but no new features, deprecations, or security fixes. The CI-action bumps have no runtime effect. Adopt it when you move to Laravel 13 or when a security fix lands, and confirm the lockfile diff is limited to constraint widening.
- What are alternatives to laravel-magic-login?
- Alternatives include building on Laravel signed URLs and notifications yourself, or using an external identity provider if you need hosted MFA, SSO, or stronger lifecycle controls. The package's advantage is a thin, framework-native implementation with no external IdP or new infrastructure. Choose based on your security review burden and whether you need features like single-use enforcement and revocation built in.
Weaver
How can I help you explore Laravel packages today?