- What is mulertech/passkey-bundle and how does passkey login work in Laravel?
- mulertech/passkey-bundle adds passwordless passkey authentication to Laravel and PHP applications using WebAuthn. It provides server-side registration and login endpoints plus a browser-side ES module, so users can sign in with device biometrics or a security key. It is designed for Composer-based Laravel apps and integrates with Blade views.
- How do I install mulertech/passkey-bundle in a Laravel app?
- Install it with Composer, then load the package's browser-side ES module on the pages that render passkey controls. The v2.0.1 patch itself requires no configuration changes, migrations, or API changes beyond a composer update. Check whether the JS asset is served from the vendor path or published to public/, because that affects asset refresh.
- Which Laravel and PHP versions does mulertech/passkey-bundle support?
- The package requires PHP 8.x and a current Laravel major according to the integration notes. The exact Composer constraints and browser support matrix for v2.x should be confirmed in composer.json and the package docs. It is built for conventional Laravel apps and also targets apps using Turbo, Livewire navigate, or similar DOM morphing.
- Does mulertech/passkey-bundle work with Livewire wire:navigate and Turbo?
- Yes, v2.0.1 is specifically aimed at apps using Turbo, Livewire wire:navigate, or any morphing DOM strategy. It replaces per-element listener binding with a single delegated listener on document, so the handler resolves the clicked button and container at click time. Confirm your particular morphing setup with a browser test, since the notes say 'any morphing equivalent' needs verification.
- How do I configure the WebAuthn RP ID and HTTPS for passkey authentication?
- WebAuthn requires HTTPS in all non-local environments and a correctly configured RP ID that matches your origin. You also need secure challenge storage and session binding on the server side. These are inherent WebAuthn requirements, not features added by the v2.0.1 patch.
- Why did passkey login stop working after upgrading to v2.0.1?
- The most likely cause is a stale browser-side JS asset, especially if the module was published to public/ rather than served from the vendor path. Re-publish the asset or bump its version, clear view and config caches, and purge any CDN or browser cache in front of the module. Composer update alone will not refresh a published asset.
- How does the delegated document click listener find the passkey button and container?
- The v2.0.1 listener resolves the clicked button and its owning container at click time from selectors or data attributes. That DOM contract is now the primary integration surface, but the provided notes do not document the exact selectors. Ask the maintainer to document them and test cases with two passkey containers, nested icons or spans, and shadow DOM.
- Is mulertech/passkey-bundle production-ready and how should I handle lost passkeys?
- The upgrade risk is low, but production passkey auth still depends on HTTPS, correct RP ID and origin, secure challenge storage, session binding, and a recovery path for lost authenticators. The patch does not address those inherent concerns. The original bug was silent, so automated tests are more useful than monitoring for catching this class of failure.
- How do I test WebAuthn passkey registration and login flows in Laravel?
- Test the full registration and login ceremonies in a browser, not just server endpoints, because the v2.0.1 bug produced no console error or server log. Cover full page loads, Turbo or Livewire navigation, multiple passkey containers on one page, clicks on inner icon elements, and asset refresh after upgrade. Use HTTPS or a local WebAuthn-capable origin for realistic results.
- What are alternatives to mulertech/passkey-bundle for passwordless Laravel auth?
- Alternatives include building on Laravel's auth with a dedicated WebAuthn library or evaluating other passkey Composer packages. Compare them on maintained Laravel version support, documented DOM contract, delegated listener behavior under Turbo and Livewire, asset delivery, and test coverage. The key differentiator is whether passkeys survive DOM morphing without silent failures.