- How do I install mpociot/teamwork in a Laravel 5 app?
- Install it with composer require mpociot/teamwork, then publish the package assets and migrations with vendor:publish and run your migrations. Add the HasTeams trait to your User model (or whichever host model should own team associations). On its native Laravel 5.x and PHP 5.6/7.0-era target this is roughly a day of work end to end, including invitations.
- Does mpociot/teamwork support Laravel 8, 9, 10 or 11?
- Not cleanly. Composer constraints cap the illuminate/* range, the service provider and facade predate modern package-discovery conventions in places, and PHP 8 will surface signature and nullability issues in the trait and models. The realistic path for newer Laravel versions is vendoring or forking rather than requiring it. The upside is that the API surface is small—roughly a dozen classes and three migrations—so a fork is tractable.
- How do I attach teams to a model with Teamwork?
- Apply the package's HasTeams trait to your User or host model, then create Team records and manage memberships through the package's models and helper service. It is a trait-based, opt-in approach: it does not own your user table, register middleware, or impose routes or a UI. That makes it additive schema plus domain helpers rather than an auth subsystem.
- How do Teamwork invitations work and are they secure?
- Teamwork provides an invite, accept, and attach flow through a small service and facade, plus an Invitation model and migrations for email invitations. The package gives you structure, not security guarantees: you inherit responsibility for token generation, single-use enforcement, expiry, email binding, and replay protection when you build the accept-invite endpoint. Audit that flow carefully before exposing it in production.
- Does mpociot/teamwork handle roles and permissions?
- Membership exists, but authorization does not. Roles are stored as a plain column, so you will either pair Teamwork with something like spatie/laravel-permission or hand-roll role checks yourself, which splits the team concept across two libraries with no shared contract. Also review $fillable on the membership model before exposing any team-management endpoint, because role columns with loose mass assignment are a classic privilege-escalation foot-gun.
- What are the best alternatives to mpociot/teamwork for Laravel teams?
- Laravel Jetstream ships teams with switching, invitations, and roles out of the box, and spatie/laravel-permission covers the roles and permissions axis Teamwork deliberately leaves to you. If you only need membership without invitations, the package is roughly 150 lines of your own code, so a small internal Membership model may be the better trade. Any adoption decision has to justify a narrow, unmaintained package over a first-party or de-facto-standard option.
- Is mpociot/teamwork abandoned or still maintained?
- Treat abandonment as the dominant risk: it has zero dependents, a low opportunity score, and no downstream pressure to keep it compatible, so your team would be the only one paying the maintenance tax. The registry metadata is also inconsistent—a last release date of 2026-09-03 is not credible for a package built against Laravel 5, so treat it as an artifact. Verify tags, commit cadence, and open-issue triage directly on the repository before any planning assumption depends on it.
- Can I use mpociot/teamwork for multi-tenant applications?
- It provides the user-to-team association but no scoping primitive, so tenant-scoped data ownership is something you build on top. If multi-tenancy is in scope, plan the scoping layer explicitly rather than assuming the package covers it. Also confirm whether Jetstream or an internal Membership model already exists in your codebase so you do not create a second source of truth.
- How do I test team invitations built with Teamwork?
- Because the package imposes no UI or routes, you are testing your own accept-invite endpoint and controller logic. Use Laravel's mail fakes to assert invitation emails and database refreshes for membership state, then explicitly assert single-use token enforcement, expiry, email binding, and replay protection since those guarantees are yours to provide. Also cover role assignment tests, because the package itself does no authorization checks.
- What database tables does mpociot/teamwork create?
- It ships migrations for teams, team_members (a pivot-like table), and invitations, so three tables land in your database under the package's naming conventions. That means replacing the package later requires a data migration off those tables, not just a code swap. Treat the schema as an ownership commitment and audit the membership model's $fillable before shipping.