Weave Code
Laravel Passkeys Laravel Package
spatie/laravel-passkeys
Spatie's Laravel Passkeys package adds passwordless login to Laravel apps, with a Livewire component for generating and storing passkeys on user devices and a Blade component for authenticating users with those passkeys.
spatie/laravel-passkeys brings passwordless authentication to your Laravel app. Instead of passwords, users create passkeys stored securely in 1Password, macOS Passwords, or another credential manager on their OS. The package handles the WebAuthn ceremony for you, so registration and login take only a few lines of Blade.
- Livewire component to generate and register passkeys
- Blade component to authenticate users with a passkey
- Built on WebAuthn — no passwords are ever stored
- Drop-in setup: requires Livewire, no custom JavaScript needed
Frequently asked questions about Laravel Passkeys
- How do I install spatie/laravel-passkeys in a Laravel app?
- Install it with Composer, publish its config and migrations, then run the migrations so passkey credentials have a table. You also need Livewire installed if you want to use the provided registration component. There is no external service or vendor account to configure.
- Does spatie/laravel-passkeys require Livewire?
- Livewire is required only for the registration component that generates passkeys. Authentication ships as a Blade component and is also available programmatically, so the rest of the package does not depend on Livewire. On an Inertia or SPA frontend you would rebuild the UI against the action layer.
- How do I log in a user with a passkey in Laravel?
- Use the provided Blade component for a drop-in passkey login form, or call authenticateWithPasskey programmatically and pass the remember flag when you want a persistent session. The package handles the WebAuthn verification ceremony through configurable action classes. You remain responsible for post-login redirects and session policy.
- How do I configure the passkey relying party ID and allowed origins?
- Set the relying party ID and allowedOrigins in the package config so they exactly match the browser origin serving your app. This must be correct for local, staging, production, and any custom domain, because mismatches surface as opaque browser-level WebAuthn failures rather than clean exceptions. Treat these values as environment-specific configuration, not hard-coded strings.
- Can I customize WebAuthn registration and authentication options?
- Yes. The package exposes configurable action classes for generating and verifying registration and authentication options, including a configurable ceremony step manager. You can adjust policies such as user verification, authenticator attachment, and attestation without forking the package. This action layer is the main extension point to budget for.
- Which Laravel versions does spatie/laravel-passkeys support?
- The package is installed via Composer and requires Laravel plus Livewire for its registration component. Recent releases track web-auth/webauthn-lib 5.3 and include a Laravel 13 support bump, so check the current composer.json constraints on Packagist before upgrading. Plan to pin webauthn-lib and schedule periodic upgrades because upstream type changes have driven several patch releases.
- Is spatie/laravel-passkeys production ready and how should I test it?
- Spatie backs the package with an MIT license, CI tests, code-style checks, and a published security policy, but public ecosystem validation is still thin with roughly 475 stars and no dependents. For testing, unit-test your configured action classes and use browser-level virtual authenticators for full ceremony flows. Hook PasskeyRegisteredEvent and configured events into your audit and telemetry pipeline before launch.
- What happens when a user loses their passkey or changes devices?
- Passkeys may be synced through iCloud Keychain, Google Password Manager, or 1Password, or they may be device-bound, so users can lose them after a device reset, ecosystem switch, or MDM policy change. The package does not include a reset-my-passkey email flow. Recovery design, fallback authentication, and support handling are your responsibility and should be planned before rollout.
- Can I use spatie/laravel-passkeys with Inertia, React, or Vue?
- The registration UX is coupled to Livewire, while authentication is available as a Blade component and programmatically. If your app uses Inertia, React, or Vue, you consume the action layer and rebuild the passkey UI yourself. That is a documented pattern, but the resulting frontend code is yours to maintain.
- How does spatie/laravel-passkeys compare to hosted passkey or identity providers?
- Hosted passkey or identity providers sell you a managed service, often with vendor accounts and per-authentication pricing. spatie/laravel-passkeys is an open-source Laravel wrapper around web-auth/webauthn-lib with no external service, no per-login cost, and credentials stored in your own database. The trade-off is that you own recovery flows, environment configuration, and edge cases, and you should pin the webauthn-lib constraint because upstream changes have driven several releases.
Weaver
How can I help you explore Laravel packages today?