Filament 2Fa Laravel Package

Product Decisions This Supports

• Unblocking enterprise/security-gated deals. Admin-panel 2FA is a standard line item on security questionnaires and a control auditors expect for SOC 2 / ISO 27001 readiness. Adopting this package converts a "we don't have that yet" answer into a "yes" at low engineering cost.
• Monetization lever. Because 2FA is a plugin toggle on the Filament panel, it can be gated to a paid tier (Team/Enterprise) with minimal engineering work — a cheap upsell hook for B2B SaaS.
• Build vs. buy. Building TOTP enrollment, QR provisioning, recovery codes, and enforcement flows is roughly a sprint of work plus permanent ownership. This package trades that for a dependency — the right call for a small team, the wrong call if 2FA is a contractual security control requiring a support SLA.
• Support-cost reduction. v3.0.0 fixes an infinite redirect loop when the panel is mounted at the base URL and a missing loading state on the login button — both are ticket-generating UX defects in the highest-traffic screen in the product.
• Roadmap and risk planning. The repo has moved from a personal namespace (Baspa) to a Backstage organization. That's either improved stewardship (good signal for keeping the dependency) or the start of a maintenance gap — worth tracking release cadence over the next two quarters before making 2FA a hard dependency in a compliance commitment.
• Localization reach. German translations landing in the same release means 2FA can be enabled for DACH customers without a custom translation override — relevant if that's an active market.

When to Consider This Package

Adopt when:

• You run a Laravel app with a Filament admin panel and need TOTP-based 2FA with recovery codes in days, not weeks.
• The team is small and 2FA is a checkbox requirement rather than a differentiated feature.
• You are comfortable owning a third-party dependency for a security-relevant control, including tracking its releases.
• You need panel-level enforcement and translations out of the box.

Look elsewhere when:

• The app isn't Filament-based — use Fortify/Jetstream or a first-party 2FA implementation instead.
• You need WebAuthn/passkeys, hardware security keys, or enterprise SSO (SAML/OIDC). This package does not cover those; pairing it with SSO is a separate workstream.
• You need a vendor support contract, SLA, or security review from the maintainer.
• You're on an older Filament major version — verify compatibility before committing.

Upgrade-specific caution for v3.0.0: the namespace changed to Backstage. This is a hard breaking change, not a patch. Any use statements, config references, published views, custom overrides, or tests touching the plugin's classes must be updated. The repository transfer also means you should confirm the Composer package name and the Packagist entry before bumping — the release notes describe the repo move but not the package rename explicitly. Budget roughly half a day to a day for the upgrade and a regression pass on the login and 2FA challenge screens. Do not allow auto-merges of this major version.

How to Pitch It (Stakeholders)

For executives: This is a small, single-purpose plugin that adds two-factor authentication to our admin panel — the control our enterprise buyers and security questionnaires keep asking about. Adopting it costs days, not a quarter, and it can be positioned as a paid-tier feature. The current release also removes two login-screen bugs that generate support tickets. The one caveat: the project just changed maintainers, so we should treat it as a monitored dependency rather than a fire-and-forget one.

For engineering: Drop-in Filament plugin providing TOTP 2FA with recovery codes. v3.0.0 is a breaking release — namespace moved to Backstage and the repo transferred organizations. Plan the upgrade deliberately: pin the current major, update class references across config and overrides, verify the Composer package name post-transfer, and regression-test the login and challenge flows. The same release fixes a base-URL redirect loop, a missing login loading state, and a translation-override bug, and adds German. If we need passkeys, hardware keys, or SSO, scope that separately — this package doesn't do it.