- Is svc/totp-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle, not a Laravel package. It registers as a Symfony bundle and builds its enrollment screens with Twig templates and Symfony form types, sitting on top of scheb/2fa-bundle. If you found it through a Laravel package index, that listing is best treated as an indexing artifact rather than an install path.
- Can I install svc/totp-bundle in a Laravel application?
- Not in any idiomatic way. Laravel uses service providers and Blade, while this package expects Symfony bundle registration, Twig, and a Scheb 2FA firewall setup, so getting it running means porting it. The practical answer is Laravel Fortify, which ships TOTP with recovery codes, or pragmarx/google2fa plus a small Blade UI.
- Does svc/totp-bundle work with Google Authenticator and Authy?
- Yes. It targets RFC 6238 TOTP, the algorithm Google Authenticator, Authy, 1Password, and most other authenticator apps consume. Secrets are exchanged as standard otpauth:// provisioning URIs, which is what those apps scan during enrollment.
- Does svc/totp-bundle require scheb/2fa-bundle?
- Yes. This package is a presentation and enrollment wrapper around scheb/2fa-bundle, which carries the actual TOTP engine. Install and configure Scheb first, publish its routes and templates, then add this bundle for the UI layer. Ordering matters, because the wrapper is not meaningful without the parent bundle in place.
- How does clock-skew tolerance work when verifying a TOTP code?
- Verification accepts codes from adjacent time steps so a slightly wrong device clock does not lock users out. The accepted window comes from the underlying Scheb configuration and this bundle's settings, so check both before tightening it. Keep the window small, since every extra accepted step widens the replay surface.
- Which Symfony versions are supported and is there a CI matrix?
- The repository does not document a supported Symfony version matrix or a visible CI pipeline, so treat compatibility as unverified. A thin UI wrapper is exactly the kind of package that breaks on Symfony major releases in the container, Form, and Twig APIs. Pin a commit and run your own test pass against your Symfony version before promoting it.
- Is svc/totp-bundle production-ready or actively maintained?
- Adoption risk is the larger concern rather than code quality. The repository shows a single maintainer, very few stars, no dependents, and no documented security disclosure process, which is a lot of trust for a component that touches secrets and authentication. Fork it under the MIT license, pin a commit, and be ready to maintain it yourself.
- How do I test TOTP enrollment and verification in automated tests?
- Because the security logic lives in scheb/2fa-bundle, most of your test effort belongs there: assert enrollment, confirmation, and verification through Symfony's test client with a fixed clock or mocked time source. Test the UI paths this bundle adds separately, including CSRF on the enrollment form and route precedence against the parent bundle's routes. Rerun that suite on every Symfony upgrade.
- What are the Laravel alternatives to svc/totp-bundle?
- Laravel Fortify is the first choice, since it ships TOTP two-factor authentication with recovery codes and is maintained by the Laravel team. pragmarx/google2fa is a solid lower-level option if you want to own the enrollment screens. Building a handful of Blade views against Fortify's contracts takes days, not weeks.
- Does it handle QR code enrollment and backup recovery codes?
- Yes for enrollment: the bundle contributes Twig templates, form types, and QR provisioning display for the enroll and confirm flow. Backup or recovery codes come from the underlying Scheb 2FA core, so confirm they are enabled and hashed correctly in your configuration. Whatever the UI shows, CSRF protection, secret leakage into logs, and rate limiting on verification remain your responsibility.