Download the PHP package happenv-com/filament-passkeys without Composer

Filament Passkeys

Multi-factor authentication for Filament panels using WebAuthn passkeys, powered by laravel/passkeys.

Key features

• Passkeys as a second factor. A native Filament multi-factor provider: after the password step, users confirm with one of their passkeys. It sits alongside Filament's app and email code providers, and users choose between the methods they have turned on.
• Passwordless sign-in on the login page. An optional "Sign in with a passkey" button under the login form signs users in with a discoverable credential, no email or password needed.
• A passkey for every device. Users can register as many passkeys as they need (Windows Hello, an Android phone, iCloud Keychain, a security key) and remove any one of them from a table on their Filament profile page. Each row shows which authenticator holds the passkey and when it was last used.
• A streamlined passkey-only challenge. When a passkey is a user's only method, the prompt opens as soon as the challenge appears and Filament's redundant "Confirm sign in" button is hidden. Both are on by default and can be turned off.
• Secure by default. Challenges are single use and bound to the user who passed the password step, so a replayed assertion or someone else's passkey is rejected. Passwordless sign-in honours laravel/passkeys login authorization and FilamentUser::canAccessPanel().
• Built on laravel/passkeys. Its actions handle challenge generation, verification and storage, and every ceremony runs through Livewire, so no extra routes are exposed.
• Testing helpers. Livewire assertions check whether signing in stops at the multi-factor challenge and whether that challenge offers a passkey.
• Upgrade path from spatie/laravel-passkeys. A migration converts existing passkeys to the laravel/passkeys schema.
• Translated into every language Filament supports (64 locales).
• Tested. A Pest suite runs real WebAuthn ceremonies against a virtual authenticator on every supported PHP, Laravel and Filament combination.

Requirements

Installation

Install the package via Composer:

Publish and run the migrations from laravel/passkeys:

Publish the laravel/passkeys config (optional, to tweak the relying party ID, allowed origins, timeout, etc.):

laravel/passkeys derives the relying party ID and the allowed origins from APP_URL. Make sure it matches the URL your panel is served from, or passkey ceremonies will be rejected.

Upgrading from spatie/laravel-passkeys

Both packages use a passkeys table and a config/passkeys.php file, so they cannot be installed side by side. Existing passkeys keep working after the switch; publish and run this package's upgrade migration instead of the laravel/passkeys one:

The migration renames authenticatable_id to user_id and data to credential, and rebuilds credential_id from the stored credential record. It does nothing when the table already has the laravel/passkeys schema. Remove the old config/passkeys.php published by Spatie and publish the new one if you need to customise it.

Configuration

Publish this package's config (optional):

Optionally, publish the views and translations:

Usage

1. Prepare your User model

Implement the HasPasskeysAuthentication contract and use the InteractsWithPasskeysAuthentication trait. They build on the laravel/passkeys PasskeyUser contract and PasskeyAuthenticatable trait:

Passkey verification counts as enabled when hasPasskeysEnabled() returns true, which by default means the user has at least one passkey. If your user model is not App\Models\User, tell laravel/passkeys about it in a service provider:

2. Register the MFA provider in your panel

In your PanelProvider, register PasskeyAuthentication in the multiFactorAuthentication() array:

That's it. The MFA section in the user profile page now shows a "Passkey verification" entry with Set up / Turn off buttons. Once a passkey is registered, Set up becomes Add passkey and a table lists every passkey with a Remove button. After a user signs in with their password, Filament asks them to confirm with one of their passkeys.

Registering FilamentPasskeysPlugin is optional. Passkeys work as a second factor without it. The plugin only adds a "Sign in with a passkey" button directly on the login page, below the standard form, so users can sign in with a passkey without typing their email and password. Leave it out if you only want passkeys as a second factor.

3. Customising the redirect URL

By default, after registering a passkey the set-up modal closes and the user stays on their profile page. To redirect them somewhere instead:

You can also set a static URL via config/filament-passkeys.php:

4. Blocking passkey sign-in

The passwordless login button honours the laravel/passkeys authorization callback, e.g. to keep suspended accounts out:

Users who fail FilamentUser::canAccessPanel() are never signed in.

5. Passkey-only challenge

When a passkey is the only multi-factor method a user has turned on, the challenge needs nothing but the "Verify with passkey" button, since the ceremony submits the form itself. By default, the passkey prompt opens as soon as the challenge appears and Filament's "Confirm sign in" button is hidden. Two options in config/filament-passkeys.php turn this off:

Users with more than one method enabled always get Filament's usual challenge. Some browsers, notably Safari, only allow WebAuthn right after a user gesture and may refuse the automatic prompt; the button stays available as a fallback.

6. laravel/passkeys routes

Every ceremony runs through Livewire, so this package does not need the HTTP routes laravel/passkeys registers and turns them off. To keep them, e.g. for the @laravel/passkeys JavaScript client elsewhere in your app, set register_passkeys_routes to true in config/filament-passkeys.php.

How it works

This package is a Filament adapter on top of laravel/passkeys. Challenge generation, attestation and assertion verification and persistence are handled by its actions; the browser side uses @simplewebauthn/browser.

• Set up / Add passkey is a regular Filament action with an optional name field. Submitting it runs GenerateRegistrationOptions and hands the options to the browser, which completes the ceremony and submits the form again so the action can store the passkey with StorePasskey. The options exclude the user's existing passkeys, so the same authenticator cannot be registered twice. A passkey saved without a name is named after its authenticator, looked up by AAGUID (e.g. "Windows Hello", "Google Password Manager").
• Remove deletes a single passkey through DeletePasskey. Removing the last one turns passkey verification off, and its confirmation says so.
• Turn off deletes each of the user's passkeys through DeletePasskey, so a PasskeyDeleted event fires for every one.
• Login challenge is a regular field of Filament's MFA challenge form. Its button generates options scoped to the user who passed the password step, and the field's validation rule checks the assertion with VerifyPasskey for that same user, so a passkey belonging to anyone else is rejected.
• Sign in with a passkey runs a discoverable-credential ceremony and logs the owner in on the panel's guard.

Testing your application

The package adds assertions to Livewire's Testable for Filament's login page, so your own tests can check that multi-factor authentication is enforced:

Translations

Supported languages

The package ships translations for every locale Filament supports. Publish them with php artisan vendor:publish --tag="filament-passkeys-translations" to adjust any wording.

tests/Unit/TranslationsTest.php checks that every locale has exactly the keys English has.

Development

The package's JavaScript and CSS are built by bin/build.js into resources/dist, which is committed. After changing resources/js or resources/css, rebuild and commit the result — CI refuses outdated assets:

Upgrading

Breaking changes and how to migrate are described in UPGRADING for every major version.

Changelog

See GitHub releases for what has changed recently.

Contributing

See CONTRIBUTING for details.

Security vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Happenv sp. z o.o.
• webard
• Jefferson Gonçalves — original author of filament-multifactor-passkeys
• Laravel — for the underlying WebAuthn implementation
• All contributors

License

The MIT License (MIT). See License File for more information.