Weave Code
Hej Laravel Package
renoki-co/hej
Hej is a Laravel package for adding user invitations to your app. It provides invite codes, acceptance flows, expiration, and Eloquent integration so you can build invite-only registration quickly and cleanly.
Hej! is a simple authentication boilerplate for Socialite.
Frequently asked questions about Hej
- What is renoki-co/hej and what does it do?
- Hej is a Laravel package that provides authentication boilerplate around Laravel Socialite, including routes, controllers, and a social-account model. It is intended for Laravel monoliths or API backends that want social OAuth login without building provider-specific flows from scratch. The package's overview also describes invitation-style registration flows, so check the repository docs for the exact feature set in your version.
- How do I install Hej in a Laravel application?
- Install the package with Composer, then publish its configuration and migrations as described in the repository. Configure your OAuth provider credentials, set allowed providers and redirects, and expose the package routes. Run migrations and clear the config cache before testing the redirect and callback flow.
- Which Laravel and PHP versions does Hej 4.0 support?
- Hej 4.0.0 keeps the package aligned with supported Laravel versions but removes Laravel 8.x support, so Laravel 8 applications cannot upgrade to this major release. Always verify the exact PHP and Laravel constraints in the package's composer.json before upgrading. Also confirm compatibility with your installed Laravel Socialite version.
- How do I upgrade Hej from 3.x to 4.x?
- Upgrade in a feature branch by bumping the Composer constraint to ^4.0, then review the release notes and pull request for breaking changes. Republish or manually merge the config, explicitly set allowed providers and redirects, and audit any custom model or controller extensions. Clear the config cache and smoke-test every enabled provider before deploying.
- How do I configure allowed OAuth providers and redirects in Hej?
- Version 4.0.0 moves redirect and allowed-provider settings into configuration, which gives you explicit control over which providers are enabled and where users are sent after OAuth. Set these values deliberately per environment and clear the config cache after changes. Stale or mismatched configuration can disable providers or misroute redirects, so include it in your deployment runbook.
- Why was $fillable removed from the Hej model and how do I add custom fields?
- Removing $fillable changes how the package model handles mass assignment, so teams that relied on adding custom fields directly to the model may see those fields dropped. The recommended approach is to extend the package controller for custom fields rather than editing the vendor model. Audit any model overrides during the 4.0 upgrade and test that your custom data is still persisted.
- Does Hej work with Laravel Socialite, and which providers can I use?
- Hej is built on Laravel Socialite, so provider support depends on Socialite and the credentials you configure. The package lets you allowlist providers in configuration, and you should test each enabled provider's redirect and callback flow in staging. If you need a provider not supported by Socialite, you would need to add that integration yourself.
- Is Hej safe to use in production, especially around OAuth redirects?
- Hej is an open-source package with a low code footprint, but you remain responsible for security review and configuration ownership. Redirects and allowed providers should be set explicitly, and you should verify that redirect handling prevents open-redirect issues in your application context. Keep provider credentials and redirect URIs in a documented runbook and monitor authentication error rates after deployment.
- How should I test Hej social login and invitation flows?
- Run your automated test suite after upgrading, then manually smoke-test each enabled provider's redirect and callback flow in staging. Confirm that config cache changes take effect, that custom controller extensions still persist fields, and that disabled providers are rejected. If you use invitation flows, test code acceptance, expiration, and Eloquent integration separately.
- Is Hej actively maintained, and what are the alternatives?
- Hej is community-supported open source with no assumed SLA, and it requires periodic major-version upgrades such as the breaking 4.0.0 release. Alternatives include using Laravel Socialite directly, Laravel Fortify or Jetstream for authentication scaffolding, or other Socialite-based packages. Teams unwilling to own an open-source dependency should evaluate those options before adopting Hej.
Weaver
How can I help you explore Laravel packages today?