- Is scheb/2fa a Laravel package?
- No. scheb/2fa is a Symfony-first two-factor authentication library with a framework-agnostic core. It ships a native Symfony bundle and Symfony Security integration, but there is no Laravel service provider, middleware, Blade scaffolding, or Laravel Auth session integration. Laravel teams can reuse some primitives, but they must build the glue themselves.
- Can I use scheb/2fa with Laravel?
- Only partially. You can consume framework-agnostic subpackages such as scheb/2fa-totp and scheb/2fa-backup-code and implement the small provider and storage interfaces against your Laravel User model. You would still need to build a custom guard or middleware, pending-2FA session state, backup-code consumption, and trusted-device handling. The Symfony bundle's enforcement workflow, event listeners, and TwoFactorToken behavior do not transfer directly.
- How much work is integrating scheb/2fa into Laravel?
- Expect a moderate-to-large effort, not a drop-in install. TOTP-only parity is roughly a few developer-days for an experienced team, longer if you add email codes, backup codes, trusted devices, and recovery workflows. The highest-risk work is your own challenge-session state, replay prevention, and single-use backup-code enforcement. Spike a small bridge before committing.
- What two-factor methods does scheb/2fa support?
- scheb/2fa supports TOTP authenticator apps such as Google Authenticator, email codes, and backup codes. It also provides an extensible provider architecture so you can add custom two-factor methods. Trusted-device support lets known browsers skip repeated code prompts.
- How do I install scheb/2fa in Symfony?
- Install the package with Composer and enable the Symfony bundle, then configure your security firewall for two-factor authentication. Use the split packages for the factors you need, such as TOTP, email, backup codes, or trusted devices. The Symfony bundle handles the enforcement workflow, preparation and validation hooks, and security token integration.
- Does scheb/2fa support trusted devices?
- Yes. Trusted-device support is provided through a separate package, scheb/2fa-trusted-device, and lets known browsers skip two-factor prompts for a period. In Symfony this is wired through the bundle's workflow. In Laravel you would need to implement trusted-device token storage, cookie or session handling, and skip logic yourself.
- How does scheb/2fa compare with Laravel Fortify or pragmarx/google2fa?
- Laravel Fortify and pragmarx/google2fa-laravel are Laravel-native options with lower integration lift and stronger ecosystem support for Laravel Auth. scheb/2fa offers a clean provider architecture, trusted devices, split factor packages, and excellent Symfony integration. For a Laravel-only app, a native option is usually the safer default unless you specifically need scheb's architecture and can own the bridge.
- What PHP and Symfony versions does scheb/2fa require?
- Recent scheb/2fa releases target PHP 8 and above and support Symfony 6 and 7. Version 8.6.1 removed an obsolete ext-json constraint on PHP 8, a low-churn maintenance signal. The package is not versioned for Laravel, so Laravel compatibility depends on your bridge and your app's PHP version.
- Is scheb/2fa actively maintained and production-ready?
- Yes, the project is MIT licensed, semantically versioned, actively maintained, and has a thorough test suite. The recent 8.6.1 release was a small compatibility cleanup, which suggests low breakage risk. For Symfony it is close to production-ready out of the box; for Laravel, production readiness depends on the security-critical bridge code you write and maintain.
- Can I add a custom two-factor provider to scheb/2fa?
- Yes. The library is built around a pluggable provider architecture, so you can define custom code generation, verification, and enrollment behavior for a new factor. In Symfony the bundle wires providers through its container and event hooks. In Laravel you can reuse the provider pattern, but you must integrate it into your own guard, middleware, and UI.