Weave Code
Fortify Laravel Package
orchid/fortify
Orchid Fortify integrates Laravel Fortify authentication into Orchid admin panels, providing login, registration, password reset, email verification, and two-factor authentication screens with configurable routes for secure Orchid applications.
Orchid template for Laravel Fortify
Frequently asked questions about Fortify
- What is orchid/fortify — a Composer package or an Orchid template?
- orchid/fortify is a reference template, not a library. It maps Laravel Fortify's headless authentication endpoints onto Orchid Platform Screen and Layout classes, with a service provider that rebinds Fortify's login, register, password reset and two-factor challenge views to Orchid screens. All of its value is Orchid-specific glue, so on a non-Orchid Laravel app it is inert. Treat it as code to copy and own rather than a dependency you track upstream.
- How do I install orchid/fortify in a Laravel Orchid application?
- You can pull it in with composer require orchid/fortify, but the safer approach is to clone it to a throwaway branch, read the service provider, routes file and auth screens, and port only the pieces you need. The template assumes Orchid Platform is already installed and pinned in your stack. After wiring the provider, confirm that /admin/login renders an Orchid form before touching any other flow, since that is the proof point for the whole integration.
- Which Laravel and Orchid versions does orchid/fortify support?
- Recent releases are dependency bumps only, so the effective supported range tracks whatever the last bump pinned. Orchid's Screen and Layout API has moved across majors and templates characteristically lag, so version drift is a real risk. Pin Orchid, Fortify and Laravel explicitly in composer.json and treat any Orchid major upgrade as a planned migration with a rendering review in staging.
- How do I stop route collisions between Fortify's /login and Orchid's /admin routes?
- Fortify registers /login, /register and /forgot-password by default while Orchid owns the /admin prefix, so collisions and guard mismatches surface at request time. Pick one authoritative guard and make config/fortify.php and config/platform.php agree on the same provider, then narrow or disable the Fortify routes you do not use. Password reset also needs the password_reset_tokens table and a broker in config/auth.php, otherwise the reset flow silently diverges from login.
- Does orchid/fortify support two-factor authentication and recovery codes?
- It binds Fortify's twoFactorChallengeView to an Orchid screen and relies on Fortify for the underlying 2FA state, so the backend capability exists once 2FA is enabled in Fortify. The template does not cover recovery-code surfacing or an admin-side reset path, and both are mandatory before shipping. Implement 2FA last, after login, reset and verification are proven, because lockout risk concentrates there and it is a support incident waiting to happen.
- How do I handle email verification with orchid/fortify without locking users out?
- Signed verification URLs must point at an Orchid route rather than Fortify's default /email/verify, otherwise gating the panel on verified status will permanently lock users out. Enable the verified middleware only after confirming the signed URL lands on an Orchid screen and redirects the user back into the panel. Test both verified and unverified paths in staging before turning the gate on in production.
- Is orchid/fortify safe and maintained enough for production?
- It has zero stars, zero dependents, no CI, no test suite and no triage, and recent releases are dependency bumps only. It is an unaudited template sitting on the most security-sensitive surface in your application, so whatever coverage exists on your auth flow is coverage your team writes. Adopt it only if at least two engineers can own it and trace login through 2FA to session end end to end.
- What alternatives are there to orchid/fortify for admin authentication?
- First check whether your pinned Orchid version already covers the requirement, particularly 2FA — if it does, the business case for this template collapses and that is the best outcome. Otherwise you can port the Fortify view bindings yourself or use Orchid's native auth screens directly. Avoid running Fortify plus Orchid's native auth plus a Breeze-style stack together, since that produces divergent password-reset behaviour and intermittent guard bugs that are miserable to reproduce.
- Does orchid/fortify support SSO, SAML, OIDC or social login?
- No. It is a thin template over Laravel Fortify, and Fortify does not do SAML, OIDC or social login. If SSO is on your roadmap, this package must not appear in any plan or deck as solving it. Plan a separate identity provider integration and keep the Orchid auth screens for local accounts only.
- How do I test authentication flows built with orchid/fortify?
- Write feature tests for each flow in sequence: login and logout landing a valid user inside the panel, password reset through the broker, email verification via a signed Orchid URL, and finally 2FA including recovery codes. There is no upstream test suite, so your tests are the only safety net on the authentication boundary. Run them against the exact Orchid, Fortify and Laravel versions you pin in production.
Weaver
How can I help you explore Laravel packages today?