Download the PHP package jeffersongoncalves/filament-multifactor-passkeys without Composer

Filament Multifactor Passkeys

Multi-factor authentication for Filament panels using WebAuthn passkeys, powered by spatie/laravel-passkeys.

Compatibility

Installation

Install the package via composer:

Publish and run the migrations from spatie/laravel-passkeys:

Publish the spatie/laravel-passkeys config (optional, to tweak relying party, allowed origins, etc.):

Publish this package's config (optional):

Usage

1. Prepare your User model

Add the Spatie InteractsWithPasskeys trait and implement the package's HasPasskeyAuthentication contract (which extends Spatie's HasPasskeys interface):

2. Register the MFA provider in your panel

In your PanelProvider, register PasskeyAuthentication in the multiFactorAuthentication() array. To also expose a "Sign in with a passkey" button on the login screen, register the plugin as well:

That's it. The MFA section in the user profile page now shows a "Passkey verification" entry with Set up / Turn off buttons. The plugin also injects a passkey login button after the standard login form, allowing users to authenticate without typing email/password. After registering a passkey, the next login can use it directly.

The package auto-registers Spatie's Route::passkeys() macro (under the web middleware group) so the login button works out of the box. If you've already registered them yourself, the auto-registration is skipped.

3. Customising the redirect URL

By default, after a successful registration or assertion the user is redirected to the current panel home (Filament::getCurrentPanel()->getUrl()). To override:

You can also set a static URL via config/filament-multifactor-passkeys.php:

How it works

This package is a thin Filament adapter on top of spatie/laravel-passkeys. The WebAuthn ceremony (challenge generation, browser API, attestation/assertion verification, persistence) is fully handled by Spatie's package and its Blade components (<x-create-passkey> and <x-authenticate-passkey>), which are embedded inside Filament modals and the MFA challenge schema.

• Set up opens a Filament modal that renders <x-create-passkey :redirect="..." />
• Disable removes all of the user's passkeys via $user->passkeys()->delete()
• Login challenge renders <x-authenticate-passkey :redirect="..." />

Development

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Jefferson Gonçalves
• Spatie — for the underlying WebAuthn implementation
• All Contributors

License

The MIT License (MIT). Please see License File for more information.