- How do I install pushery/email-magic-link-for-laravel?
- Install it with Composer using composer require pushery/email-magic-link-for-laravel, then follow the README to publish configuration and connect the package to your Laravel auth flow. The package is designed to integrate with Laravel's existing authentication system, so you typically configure routes, mail settings, and optional branding seams rather than rebuilding authentication.
- Does this package support passwordless authentication in Laravel?
- Yes. It adds passwordless authentication by emailing signed, time-limited magic links that log users in after a click. Users request a link, receive it by email, and are authenticated without a password. It integrates with Laravel's auth system and includes configurable expiration, email delivery, views, and routes.
- Which Laravel and PHP versions are supported by this magic link package?
- The provided context does not list exact Laravel and PHP version constraints, so check the package composer.json and README for the current support matrix. The v0.36.0 evaluation notes that it is intended to retain the same support matrix as v0.34.0, but verify that before upgrading. Also confirm any suggested WireKit version if you use the customizable UI layout.
- How do magic link expiration and security work?
- Magic links are signed and time-limited, and link expiration is configurable. Treat magic links like credentials: use HTTPS, avoid logging tokens, and keep expiration short enough for your risk model. The package validates links, but your application still owns rate limiting, abuse monitoring, and operational safeguards.
- How do I customize the magic link email and login screens?
- You can customize email delivery and link expiration through configuration. In v0.36.0, the optional ui.layout setting lets request, confirmation, and code screens render inside a host Blade component. The package keeps bundled mail and layouts as fallbacks, so it works without customization; if ui.layout is missing or unresolvable, it logs a warning and uses its own layout.
- What is mail_identity and when should I configure it?
- mail_identity binds a class implementing the MailIdentity contract so magic-link and code mail can use your application or tenant name and recipient greeting. If it is absent, the package falls back to app.name and the bundled greeting. Configure it when you want branded transactional email without forking package views, and confirm the exact method signature in the source or README.
- Can I use this package with multi-tenant Laravel applications?
- The package supports multi-tenant scoping, but mail_identity and ui.layout are global configuration values. If different tenants need different sender identities or layouts, verify that your MailIdentity implementation receives enough account or request context and whether layout selection can be made tenant-aware at runtime. Otherwise you risk misbranded mail or inconsistent UI across tenants.
- How do I test magic link authentication in Laravel?
- Test the full flow by requesting a link, asserting that the expected notification or mail is sent, extracting the signed URL in your test, and confirming the user is authenticated after visiting it. Use Laravel mail and notification fakes where appropriate. Also test expired links, invalid signatures, and fallback behavior when mail_identity or ui.layout is not configured.
- Is it safe to use email magic link login in production?
- The design is defensively oriented: MailIdentity exceptions are reported and mail still sends with the bundled identity, while unresolvable layouts fall back with a warning. That protects sign-in availability but can hide branding or tenant-naming mistakes, so monitor logs and add assertions around mail content. Use HTTPS, rate limiting, short expirations, and careful token handling in production.
- What are alternatives to email magic links for Laravel authentication?
- Alternatives include Laravel's built-in password reset, custom signed URL login patterns, Laravel Fortify or Breeze with a passwordless flow, and other magic-link packages. Choose based on first-party maintenance, multi-tenant branding needs, whether you need code-based fallback, and how much of the invitation and token lifecycle you want to own.