Weave Code
Laravel Login Link Laravel Package
spatie/laravel-login-link
Drop the x-login-link Blade component into your login view to instantly sign in as any seeded test user—no more juggling credentials or roles. Links render only on localhost and allowed hosts, so it stays safe for local development.
spatie/laravel-login-link removes friction from local development by replacing hard-to-remember test credentials with one-click login links. Add the Blade <x-login-link> component to your login view—ideally wrapped in @env('local')—and instantly sign in as any seeded user. Host access is restricted by default to localhost, with configurable allowed_hosts for other environments.
- One-click authentication via Blade component
- Custom email and label per link
- Local-only rendering with
@env('local') - Host allowlist via
allowed_hosts - Ideal for admin sections and multi-role testing
Frequently asked questions about Laravel Login Link
- How do I install spatie/laravel-login-link in a Laravel app?
- Install the package with composer require spatie/laravel-login-link, then optionally publish the config if you need to change defaults. Add the x-login-link Blade component to your login view, wrapped in @env('local') so it only renders locally. You can pass email and label attributes for each seeded user you want to expose.
- Is spatie/laravel-login-link safe to use in production?
- No. The package is explicitly a local-development convenience and becomes an account-takeover vector if it is reachable in a public or shared environment. Defaults restrict environments and hosts, but configuration drift is the main failure mode, so review allowed_environments and allowed_hosts before every rollout. Keep the component behind @env('local') and add negative tests to confirm links do not render outside local.
- How do I configure allowed hosts for laravel-login-link?
- Publish the package config and edit the allowed_hosts key. Only localhost is allowed by default, so add entries like example.com or a local Docker hostname if developers reach the app through another domain. Any host not in the list is rejected, which is the main guard against accidental exposure.
- Which Laravel and PHP versions does spatie/laravel-login-link support?
- Support depends on the package major: version 2 requires PHP 8.3 or higher and drops Laravel 10, and late 1.x releases also changed PHP and Laravel constraints. Check the selected release against your app's PHP and Laravel versions before installing. Pin an explicit version per application rather than using a floating constraint across a multi-app portfolio.
- How do I use laravel-login-link with Inertia and Vue or React?
- Share the current environment through HandleInertiaRequests, then import the vendor-provided Vue or React component and render it only when the environment is local. This keeps the same one-click behavior without using the Blade component. For other JavaScript stacks, fall back to the documented POST contract instead of reimplementing login logic.
- Can I use laravel-login-link with a custom user model or auth guard?
- Yes. The package supports existing auth guards, custom user models, user-attribute selection, and redirect routes, so it fits apps that do not use the default User model. Set the relevant options in the config so the package authenticates the correct guard and user. If you override the controller or middleware, verify the host and environment checks still apply.
- Does laravel-login-link automatically create missing users?
- The package can auto-create users that are not found, controlled by the automatically_create_missing_users setting. That is convenient locally but can pollute local or staging databases with unintended accounts. Disable it if you want to protect seed data and catch typos in configured email addresses.
- How do I use the login link from a non-Blade JavaScript frontend?
- Use the documented POST endpoint at /laravel-login-link-login and include the CSRF token with the request. This is the supported contract for frontends that cannot use the Blade or vendor Vue/React components. Do not reimplement the login logic yourself, because the endpoint already enforces the allowed hosts and environments.
- Should spatie/laravel-login-link be installed as a require-dev dependency?
- Install it as require-dev whenever the links are only needed for local development, so it stays out of production installs. Use a production dependency only if you genuinely need the links on remote or staging environments, and then lock down allowed_environments and allowed_hosts first. Assign someone to review that config as part of the release checklist.
- What are the alternatives to spatie/laravel-login-link for quick local logins?
- Alternatives include writing your own local-only login route or using an impersonation package for switching users. The trade-off is that custom routes need their own host and environment guards, which is exactly what this package provides out of the box. For most Laravel apps, a small Blade component plus the built-in host restrictions is the lowest-effort option.
Weaver
How can I help you explore Laravel packages today?