Filament Webauthn Laravel Package

Product Decisions This Supports

• Passwordless / passkey roadmap bets. Decides whether "sign in with Touch ID / Windows Hello / security key" ships this quarter as a differentiator or stays in the backlog. The package makes the cost side of that equation concrete: server-side WebAuthn ceremony handling plus Filament front-end (Alpine) components are already wired, so the remaining work is product surface (enrollment prompts, device management, recovery), not cryptography.
• Security posture vs. feature velocity. Passkeys cut credential-stuffing and phishing exposure on your highest-value accounts — typically Filament admin panels and back-office operators, which are exactly the accounts attackers target. This is a "reduce blast radius" decision you can justify without a full CIAM migration.
• Build vs. buy (vs. fork). WebAuthn registration/authentication ceremonies, challenge lifecycle, origin/RP-ID validation, and signature-counter checks are well-specified but easy to get subtly wrong. Building in-house is roughly 2–4 engineer-weeks plus a security review; this package collapses that to an integration spike. Because it's MIT, the realistic third option is "adopt, pin, and fork if abandoned."
• Support-cost and recovery-flow scoping. Passwordless shifts cost from "password reset tickets" to "lost device / add a second passkey" flows. Committing to this package forces the product decision on account recovery — a decision that has real support and lockout-risk implications.
• Procurement / compliance answers. Passkeys align with FIDO2 and NIST 800-63B guidance and help answer enterprise security questionnaires ("do you support phishing-resistant MFA?"). Useful input for sales enablement and for pricing higher-tier plans with stronger auth.
• Buyer-segment validation. If your ICP is security-conscious SMB/mid-market or regulated, passwordless is a wedge. If your ICP is enterprise IT, this package does not satisfy SSO/SAML/SCIM expectations and shouldn't be positioned as such.

When to Consider This Package

Consider it when:

• You already run Filament (v3/v4 — verify compatibility against your pinned version) and the accounts you want to protect live in or behind a Filament panel.
• You want a time-boxed spike or internal-tool deployment to validate passkey UX before investing in a full identity provider.
• Your auth needs are simple and first-party: username + optional passkey, no complex tenant/role federation.
• Your team is comfortable owning the dependency — reading the source, pinning the version, and patching it if upstream goes quiet.
• The target population is staff/admins (small, known, supportable) rather than a mass consumer base with heterogeneous devices.

Look elsewhere when:

• You're not on Filament — the value is largely the panel integration; a plain web-authn library or laragear/webauthn is a better fit.
• You need enterprise SSO, SAML/OIDC, SCIM provisioning, or MFA policy enforcement — that's Auth0/WorkOS/Okta/Clerk territory.
• You need audited, SLA-backed, maintained auth. With ~14 stars and a 0.38 health signal, treat this as an early-stage reference implementation, not a vendor. Budget for reading and vendoring the code, and independently review the underlying WebAuthn library it wraps.
• You need out-of-the-box device management, recovery codes, or passkey lifecycle UI — those are yours to build.
• You need native mobile passkeys or cross-platform credential sync guarantees.

How to Pitch It (Stakeholders)

For executives (one paragraph): Passkeys are becoming the default expectation for secure login, and they measurably reduce account-takeover risk and password-reset support load. This package lets us ship passwordless login into our existing Filament admin surfaces in days rather than weeks, at zero license cost (MIT), and it strengthens our answers on security questionnaires. The caveat is maturity: it's a small, early project, so we should treat it as a scoped experiment on internal/admin accounts, pin the version, and plan to own the code — not as a replacement for an identity provider.

For engineering (the ask): Time-box a one-sprint spike: integrate against a staging Filament panel, review the WebAuthn ceremony implementation and its dependency, confirm version support, and document the recovery flow and device-enrollment UX we'd have to build ourselves. Deliverable is a go/no-go with an estimate for the surrounding product work — not a production rollout. If the spike slips or the dependency looks unmaintained, fall back to the underlying WebAuthn library directly and keep the panel glue in-house.