Weave Code
Filament Passport Laravel Package
webteractive/filament-passport
Manage Laravel Passport OAuth clients, access tokens, and authorization codes from Filament, with built-in consent views for authorization and device flow so Passport works out of the box.
A Filament plugin to manage Laravel Passport OAuth clients, tokens, and auth codes.
Frequently asked questions about Filament Passport
- How do I install webteractive/filament-passport in a Laravel app?
- Install Laravel Passport first with php artisan install:api --passport, then run composer require webteractive/filament-passport. Register the plugin by adding FilamentPassportPlugin::make() to the plugins array in your panel provider. Publishing the config with php artisan vendor:publish --tag=filament-passport-config is optional but recommended if you plan to customise behaviour.
- Does Filament Passport support Filament 4 and Filament 5?
- Yes, the package supports Filament 4.x and 5.x alongside Laravel Passport 12.x and 13.x, and requires PHP 8.2 or higher. Device flow features are the only exception, since they need Passport 13. Because the matrix spans multiple major versions, test your exact pinned combination before rollout.
- Do I need Laravel Passport installed before using this plugin?
- The plugin is a Filament UI layer over Passport's existing models, so Passport must already be installed, keyed, and migrated. If Passport is not part of your architecture, this package adds nothing and is not a reason to adopt Passport. There are no package-owned migrations, so removing it leaves your auth data intact.
- How do I customise the built-in OAuth consent views?
- Publish the views with php artisan vendor:publish --tag=filament-passport-views, which copies them to resources/views/vendor/filament-passport where they take precedence. Edit those files to match your branding and consent copy. The authorization, device authorization, and device user code screens can each be replaced independently.
- Can I disable or override a single consent view, for example when using Laravel MCP?
- Yes, the config file exposes a views array where each entry accepts a custom view name or null. Setting authorization to null makes the package skip registration so you can register your own consent view, such as the one Laravel MCP requires, in your AppServiceProvider. The views enabled flag acts as a master switch for all of them.
- Who can access the Filament Passport client and token resources by default?
- Access is ordered: the viewFilamentPassport gate, then the plugin's canAccess callback, then open access by default. That default-open behaviour means installing the plugin without configuration leaves client and token management reachable by anyone who can load the panel. Treat restricting access as an explicit acceptance criterion and review the privilege-escalation surface of token administration.
- Which Laravel Passport version is required for the device authorization flow?
- Device Authorization grant support requires Laravel Passport v13, and the device authorization and device user code consent views are only registered on that version. OAuth client, access token, and authorization code management plus the standard authorization consent screen work on both Passport 12 and 13.
- Does Filament Passport add its own database tables or migrations?
- No. The plugin reads and writes Passport's own Eloquent models (OauthClient, OauthAccessToken, OauthAuthCode) and ships no tables or proprietary identity store. Adoption is therefore reversible: uninstalling it removes admin screens, not your data or authentication behaviour.
- Does the package work with multi-panel or multi-tenant Filament setups?
- Multi-panel and multi-tenant behaviour is not documented or verified by the maintainer. The package assumes the conventional shape of a Filament back office with Passport as the API guard on a single default guard. If you run multiple panels or tenancy, test access isolation yourself rather than assuming support.
- Is webteractive/filament-passport actively maintained and safe for production?
- It is at v1.0.0 with a single maintainer, minimal stars, and no documented backward-compatibility policy, so the ecosystem offers little assurance. The code is MIT licensed and small, which makes auditing the source and forking a practical contingency. Schedule a security review of the token administration screens and consent views before production use.
Weaver
How can I help you explore Laravel packages today?