wetcat/fortie
Fortie is a Laravel package that offers a simple, customizable authentication UI and scaffolding powered by Laravel Fortify. It helps you quickly set up login, registration, password reset, email verification, and account management without building forms from scratch.
Architecture fit. wetcat/fortie is a Laravel-oriented wrapper around the Fortnox API, which is Swedish accounting/ERP software (invoicing, customers, vouchers, bookkeeping). Fit is therefore narrow but deep: it is valuable only if the product must exchange data with Fortnox — typically a Swedish/Nordic SaaS that pushes invoices, syncs customers, or exports accounting entries. For a Laravel codebase it should slot in as a composer dependency with a service provider, publishable config, and env-based credentials, which is the conventional and low-friction shape.
Integration feasibility. Onboarding is likely a composer require, config publish, and OAuth2 client setup through the Fortnox Developer Portal (app registration, client ID/secret, scopes). The real feasibility question is not installation but whether the package owns the OAuth lifecycle: Fortnox uses OAuth2 with refresh tokens and per-tenant authorization, so token storage, refresh, and multi-tenant isolation must be handled deliberately. A package that leaves token persistence to the host app is fine — but that becomes our work.
Technical risk. The headline risk is stewardship, not code: 19 stars, zero dependents, and a single commercial maintainer (Wetcat Studios) imply a high bus factor and a thin community. Fortnox evolves its API and rate-limit model, and an unmaintained wrapper decays quickly. Secondary risks: unknown test coverage, unclear handling of 429s and retries, and whether credentials/tokens are stored securely by default. Apache-2.0 is permissive and low-risk legally, and the small surface area means forking is realistic if needed.
Key questions.
Stack fit. Best fit is a Laravel monolith or modular Laravel service already holding tenant data. It is a poor fit for polyglot or non-Laravel stacks, and pointless outside Nordic accounting workflows. Confirm composer constraints against our Laravel/PHP baseline before committing.
Migration path. If we already call Fortnox via raw Guzzle or bespoke clients, introduce the package behind our own FortnoxClient interface rather than scattering its API through the codebase. That preserves portability if the vendor stalls and lets us swap or fork without touching domain code. If the package lacks required endpoints, prefer extending/forking over a parallel integration to avoid two auth paths.
Compatibility. Verify Illuminate support, PHP versions, Guzzle major version, and OAuth library overlap with other dependencies. Validate against a Fortnox sandbox tenant, not production, and confirm the app registration model (integration vs. partner) matches how customers will authorize us.
Sequencing. (1) Sandbox PoC: complete OAuth flow and one read endpoint. (2) Wrap behind our interface and add token persistence with per-tenant isolation. (3) Implement the two or three highest-value entities (customers, invoices). (4) Add retry/backoff and observability around the client. (5) Feature-flag a pilot tenant. (6) Harden and document before broadening scope.
Maintenance. Low ongoing code burden if the package is stable, but the dependency is effectively self-supported. Pin the version, track upstream commits, and budget a small contingency for a fork or in-house replacement. Treat it as a component we may eventually own.
Support. With no meaningful community, support is our engineers reading Fortnox docs and package source. Plan for that in estimates; do not assume vendor SLAs.
Scaling. Throughput is bounded by Fortnox rate limits per app/company, not by the package. Route writes through queued jobs with backoff, batch where the API allows, and cache reads. Multi-tenant growth multiplies token and rate-limit bookkeeping, so design tenant-scoped clients from day one.
Failure modes. Expired or revoked refresh tokens, Fortnox maintenance windows and 5xx responses, 429 throttling, API schema drift, and silent accounting mismatches (VAT, rounding, voucher series) that are costly to unwind. Credential leakage is the highest-severity mode. Each needs explicit handling: alerting on auth failures, dead-letter queues for failed writes, and reconciliation checks against Fortnox.
Ramp-up. A Laravel developer can be productive in days; the real learning curve is Swedish bookkeeping domain knowledge (BAS accounts, VAT rules, voucher structure), which the package does not teach. Budget for domain review alongside engineering.
How can I help you explore Laravel packages today?