- How do I install and configure wotz/laravel-verification-code in a Laravel app?
- Install it with Composer, publish its configuration, and complete any migrations or cache setup described in the README. Add the package trait or service integration to your user model, configure the email or SMS notification channel, and expose request-code and verify-code endpoints. Confirm the exact commands and namespace against the repository because the overview does not include a full install guide.
- Which Laravel and PHP versions does wotz/laravel-verification-code support?
- The provided overview does not list exact Laravel and PHP version constraints, so check the package composer.json and README before adopting it. Test the package in your application's supported Laravel and PHP matrix, including queue and notification behavior. The recent release is positive, but the evaluation notes that upgrade lag is a risk to monitor.
- Can I use this package for passwordless login in Laravel?
- Yes, it fits Laravel's native verification-code challenge pattern: request a code, verify it, then issue your application's normal session or Sanctum token. Treat it as an authentication primitive rather than a full identity platform. For production, add threat modeling, abuse controls, observability, and fallback behavior around it.
- Does wotz/laravel-verification-code support SMS delivery as well as email?
- The package blurb says it supports email or SMS delivery, so SMS is in scope if you configure a compatible notification channel and provider. Validate provider constraints, delivery latency, rate limits, localization, and test-environment behavior before rollout. The overview does not enumerate specific SMS providers, so confirm integration details in the README.
- Are verification codes hashed at rest in this Laravel package?
- The overview does not state whether codes are hashed at rest, although it does mention custom storage drivers. Treat hashing as a security review item and inspect the implementation or storage driver before production use. If hashing is not built in, add a custom driver or wrapper that stores only hashed codes.
- How do I configure code expiry, attempt limits, and rate limiting?
- The package advertises configurable length, expiry, attempt limits, and rate limiting, typically through published configuration. Review the exact semantics for one-time use, invalidation, and whether limits apply per user, IP, device, or tenant. Test these controls explicitly because the evaluation flags brute force, replay, and enumeration as key risks.
- Is wotz/laravel-verification-code production-ready for authentication?
- It is security-critical functionality with limited public evidence: 58 stars and 0 dependents indicate low visible production adoption. The recent release is positive, but maturity, maintainer depth, test coverage, and long-term support are unproven. Fund a short spike and security review covering entropy, storage, replay, brute force, enumeration, throttling, expiry, and delivery outages before committing.
- Can I use custom storage drivers with this verification code package?
- Yes, the package supports custom storage drivers, which helps align it with your existing Laravel cache or database conventions. Confirm driver assumptions, migration conflicts with existing user tables, cleanup jobs, and queue behavior. Wrapping storage behind an internal interface reduces lock-in and makes forking or patching easier.
- How do I migrate from existing OTP logic to wotz/laravel-verification-code?
- Treat it as a bounded replacement for existing OTP logic, not a wholesale auth migration. Put it behind a feature flag and an internal VerificationCodeService interface, run it in parallel by cohort, shadow-verify where safe, and retain a fallback path until metrics and security checks pass. Add automated tests and canary it with a low-risk cohort before expanding.
- Who maintains wotz/laravel-verification-code and what support can I expect?
- The repository is maintained under the wotzebra GitHub organization, but the evaluation notes single-maintainer or low-adoption risk and expects little or no commercial vendor support. Pin versions, monitor releases and CVEs, test Laravel and PHP upgrades early, and maintain an internal fork or patch path. Engineering leadership should explicitly accept the maintenance risk before production use.