- How do I install vormkracht10/filament-two-factor-auth in a Laravel Filament app?
- Install the package with Composer, then register the plugin on the Filament panel where you want two-factor authentication. Publish any provided configuration, views, or translations and run migrations if the package includes them. For v3.0.0, confirm the current Packagist package name and install command from the repository or README before upgrading, because the namespace changed to Backstage.
- Does this package require Laravel Fortify?
- Yes, the package is designed to integrate Laravel Fortify two-factor authentication into Filament panel logins. It adds TOTP enrollment through authenticator apps with QR codes, plus recovery codes. You should already have Fortify configured or be prepared to wire it into your Laravel auth stack alongside Filament.
- Which Laravel, PHP, and Filament versions are supported?
- Check the package composer.json and README for the exact PHP, Laravel, and Filament version constraints rather than relying only on release notes. This is especially important for v3.0.0, which includes a namespace and repository governance change. Treat v3 as incompatible until you have verified the constraints and tested it against your application's versions.
- How do I enforce two-factor authentication for all users in a Filament panel?
- The package lets admins enforce 2FA panel-wide so users must enroll before or during login. Configure enforcement through the Filament plugin setup for the relevant panel and test the enrollment and challenge flows for existing and new users. Confirm the exact configuration keys in the package documentation for your installed version.
- What happens if a user loses access to their authenticator app?
- The package supports recovery codes so users can still complete the two-factor challenge if their TOTP device is unavailable. You should confirm how recovery codes are generated, displayed, and regenerated in your installed version. For admin accounts, document a support process for recovery-code use or account reset before enforcing 2FA widely.
- Is v3.0.0 a drop-in upgrade from v2?
- No, v3.0.0 is a controlled major-version migration because the namespace changed to Backstage and the repository moved. Pin your current v2 version first, create an upgrade branch, search for old namespace references, update imports, and republish any config, views, or translations. Clear config and view caches and run full admin-auth regression tests before production.
- Why am I getting a redirect loop when Filament is served from the base URL?
- A redirect loop can occur when the Filament panel path is the site root, and v3.0.0 includes a fix for that scenario. Upgrade to the fixed version and explicitly test login, 2FA challenge, and redirect behavior in a root-path deployment. Also review panel path configuration and authentication middleware to rule out application-level conflicts.
- How do I customize or override the package translations?
- Publish the package translations and override the strings in your application's language files, then clear caches and verify the localized admin login and 2FA screens. Version 3.0.0 includes translation override fixes, but the namespace and translation paths may have changed. Recheck existing overrides after upgrading rather than assuming they still resolve.
- How should I test two-factor authentication before deploying to production?
- Build an automated and manual regression suite covering login, QR enrollment, TOTP challenge, recovery-code login, translation overrides, and root-path redirect behavior. Run it in local and staging environments with production-like panel paths and locale settings. Because this is authentication, coordinate a rollback plan for admin access before rolling out to production.
- Is this package safe and well maintained for production admin panels?
- It fits Laravel applications already using Filament that need MFA for privileged users, but the technical risk is medium because authentication regressions are high impact. The repository transfer to Backstage means you should confirm the support, release, and security-response model before relying on it. Pin versions, review dependency updates, and keep an admin-access rollback plan in place.