- How do I install filament-two-factor-authentication in a Laravel app?
- Run composer require stephenjude/filament-two-factor-authentication, add the TwoFactorAuthenticatable trait to your auth model, and implement the Spatie HasPasskeys interface on that model. Then run php artisan filament-two-factor-authentication:install, which publishes the migrations for the user columns and passkey tables, and register the plugin in your Filament panel provider. The package targets Laravel 10 through 12 and PHP 8.2 or newer. Pin an exact version so upgrades go through review.
- Does this package support Filament 4 or only Filament 3?
- Both, but through separate release lines: the 2.x branch targets Filament 3 and the 3.x branch targets Filament 4. Check the package's composer constraint against your installed Filament minor version rather than assuming ^3.0 semantics carry over. There is no stated published policy yet for Filament 5, so confirm which branch will receive security patches before you commit.
- Does it support Google Authenticator and TOTP codes?
- Yes, TOTP is the primary factor and works with Google Authenticator and any compatible authenticator app. You enable it per panel with enableTwoFactorAuthentication() in the plugin registration. The settings UI ships as Livewire components, so you can embed it in an existing profile page instead of using the default menu item. Check the source for which TOTP library backs the codes and confirm secrets are encrypted at rest with a documented key-rotation story before rollout.
- How do I add passkey (WebAuthn) login to a Filament panel?
- Call enablePasskeyAuthentication() on the plugin and make sure your auth model implements HasPasskeys, since the package delegates to spatie/laravel-passkeys under the hood. Passkeys bring real WebAuthn constraints: a fixed RP ID, HTTPS origin binding, and browser and device support you must test. Budget weeks rather than days for this path, and settle your domain configuration before enabling it in production. A sensible sequence is TOTP first, passkeys later.
- Can I use this for 2FA on my Laravel API or a customer-facing frontend?
- No. This is a Filament panel plugin, not a general Laravel two-factor solution. It hooks into the panel auth flow through a trait, plugin registration, and the TwoFactorChallenge and ForceTwoFactorSetup middleware, so API-only auth, separate customer frontends, and non-Filament admin surfaces get no protection at all. If you need 2FA across multiple entry points, look for a broader Laravel package or implement the challenge yourself.
- Does the plugin work correctly with multiple Filament panels and guards?
- Registration is per panel, and the challenge middleware is injected into that panel's auth flow, so in principle each panel is scoped independently. In practice the changelog shows panel-scoping fixes in 2.0.4 and 2.0.6, which means this exact class of bug has appeared more than once. If you run several panels or guards, explicitly test that enabling the plugin on one panel does not leak the challenge or force-setup middleware into another.
- How do I force users to enable two-factor authentication?
- The package ships a ForceTwoFactorSetup middleware that you add to the panel's auth middleware stack, which redirects users into the setup flow until they enrol. Combined with the TwoFactorChallenge middleware, that covers both enforcement and verification on each login. Note that a forced-enrolment policy needs an exception path for service accounts and a documented break-glass procedure, otherwise a locked-out super-admin has no way back in.
- Are recovery codes hashed and single-use, and how do admins reset 2FA for a locked-out user?
- Recovery code handling is a detail you should verify in the source before relying on it, specifically whether codes are hashed at rest and invalidated after one use. There is no documented admin reset or self-service reset flow in the package, so plan on building one yourself. Also define a break-glass procedure for a super-admin who loses both their device and their recovery codes, because the plugin alone will not provide one.
- Is this package production-ready for authentication?
- Treat it as a young security surface. It has roughly 87 stars and no dependents in the data we reviewed, a single primary maintainer with community PRs, and a changelog showing repeated correctness fixes in the core auth flow, including panel scoping, middleware and translation fixes, and a switch from hash to decrypt validation of the challenge token. That does not mean it is broken, but authentication failures mean account takeover, so route it through platform ownership and a security review rather than a feature ticket. Pin an exact version, review the dispatched events for audit evidence such as SOC 2 access control, and agree a fork or ownership plan since there is no vendor SLA.
- How do I remove or roll back two-factor authentication after installing it?
- The fast rollback is to remove the plugin registration from the panel provider and pin back to the previous exact version; the trait and published columns should then be inert. Verify that explicitly in a staging environment before rollout, since it is your only quick way out. Avoid publishing views or altering the auth model further than necessary so the revert stays a single-step change.