Download the PHP package joe-404/laravel-auth without Composer

On this page you can find all versions of the php package joe-404/laravel-auth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of joe-404/laravel-auth

Informations about the package laravel-auth

joe-404/laravel-auth — Complete Laravel Authentication Package

⚠ BETA / TESTING NOTICE This package is still under active testing. Bugs may exist. Use with caution in production and report any issues you encounter.

A drop-in, config-driven authentication library for Laravel 12 and 13. One package, one command, and your app has a complete auth system: registration with OTP + magic-link email verification, login, token refresh, password reset, multi-session management, Google OAuth, long-lived API tokens, account status workflow (suspend/ban/deactivate), device fingerprinting, and a referral code system with anti-abuse detection — all through a uniform JSON API, no frontend coupling.

Works with: REST APIs · SPA (cookie session) · Mobile apps (Bearer token)

Latest Version on Packagist PHP Laravel

Table of Contents

What Problem Does This Solve?

Every new Laravel project needs authentication. The typical options are either too coupled to a frontend (Breeze, Jetstream) or too minimal (Fortify, raw Sanctum). Developers end up rebuilding the same things from scratch:

joe-404/laravel-auth solves all of this in a single package. Install it, run php artisan auth:install, and every feature above is live — config-driven, fully customizable, and completely decoupled from any frontend.

Features

Requirements

Dependency Version
PHP ^8.2
Laravel ^12.0 or ^13.0
Laravel Sanctum ^4.0 (installed automatically)
Laravel Socialite ^5.0 (installed automatically)
Spatie Permission ^6.0 (installed automatically)
Redis phpredis or predis (recommended for OTP, refresh token, and rate-limit storage)

Installation

Add the required traits to app/Models/User.php:

Set the minimum environment variables:

Full install walkthrough, manual steps, and troubleshooting: docs/installation.md

Quick Start

Three-step registration, then login:

Every response uses the same envelope:

API Endpoints

Method Path Auth Description
POST /auth/register — Initiate registration (send OTP / magic link)
POST /auth/register/verify-otp — Verify OTP → receive completion_token
GET /auth/register/verify-magic/{token} — Verify magic link → receive completion_token
POST /auth/register/complete — Set password and create user
POST /auth/email/resend-verification — Resend OTP / magic link
POST /auth/login — Login (password auth)
POST /auth/logout ✓ Revoke current session
POST /auth/logout/all ✓ Revoke all sessions
GET /auth/me ✓ Current user + roles
POST /auth/token/refresh — Rotate refresh token
POST /auth/password/forgot — Request password reset
POST /auth/password/reset/verify-otp — Verify reset OTP → reset_token
GET /auth/password/reset/magic/{token} — Verify reset magic link → reset_token
POST /auth/password/reset/confirm — Set new password (auto-login)
POST /auth/password/change ✓ Change password (authenticated)
POST /auth/password/confirm ✓ Sudo mode — confirm password for step-up (v2.6)
POST /auth/phone/send-otp ✓ Send a phone verification code (v2.6)
POST /auth/phone/verify ✓ Verify a phone code (v2.6)
GET /auth/2fa/methods ✓ List enrolled 2FA methods (v2.6)
POST /auth/2fa/enroll/{method}/start ✓ Begin enrolling totp/email/sms (v2.6)
POST /auth/2fa/enroll/{method}/verify ✓ Confirm enrollment (returns backup codes once) (v2.6)
POST /auth/2fa/methods/{id}/default ✓ Set default 2FA method (v2.6)
DELETE /auth/2fa/methods/{id} ✓ Remove a 2FA method (v2.6)
GET /auth/2fa/backup-codes ✓ Backup-code summary (v2.6)
POST /auth/2fa/backup-codes/regenerate ✓ Rotate backup codes (v2.6)
POST /auth/2fa/challenge challenge_token Complete login 2FA → real token (v2.6)
POST /auth/2fa/challenge/switch challenge_token Switch to another enrolled method (v2.6)
POST /auth/2fa/challenge/resend challenge_token Re-send the current method's code (v2.6)
GET /auth/trusted-devices ✓ List trusted devices (v2.6)
DELETE /auth/trusted-devices/{id} ✓ + step-up Revoke a trusted device (v2.6)
DELETE /auth/trusted-devices ✓ + step-up Revoke all trusted devices (v2.6)
GET /auth/sessions ✓ List active sessions
DELETE /auth/sessions/{id} ✓ Revoke a session
GET /auth/devices ✓ List every device that has ever logged in (permanent history)
DELETE /auth/devices/{id} ✓ Forget a device
GET /auth/social/google/redirect — Google OAuth redirect
GET /auth/social/google/callback — Google OAuth callback
POST /auth/social/complete completion_token Finish OAuth signup with required profile fields (v2.6)
GET /auth/social/{provider}/link/confirm/{token} — Confirm social account link
GET /auth/api-tokens ✓ List your API tokens
POST /auth/api-tokens ✓ Create an API token
DELETE /auth/api-tokens/{id} ✓ Revoke an API token
GET /auth/admin/api-tokens admin List all API tokens
POST /auth/admin/api-tokens admin Create a system token
PATCH /auth/admin/api-tokens/{id} admin Update a token
DELETE /auth/admin/api-tokens/{id} admin Revoke any token
GET /auth/admin/users/{id}/status admin Get user status
POST /auth/admin/users/{id}/status admin Change user status (suspend / disable / restore)
GET /auth/admin/users/{id}/status/history admin Status audit log
POST /auth/admin/users/{id}/notes admin Add admin note
POST /auth/account/deactivate ✓ Self-pause account
DELETE /auth/account ✓ Self-delete account (30-day grace)
POST /auth/referrals/redeem ✓ Submit a referral code after registration
GET /auth/referrals ✓ List your referrals + status
GET /auth/referrals/stats ✓ Aggregate counts of your referrals
GET /auth/admin/referrals admin List all referrals
PATCH /auth/admin/referrals/{id} admin Override referral status

Routes are mounted at /auth by default. Set routes.prefix in config/auth_system.php to change (e.g. api/v1/auth).

Why joe-404/laravel-auth Instead of X?

Feature joe-404/laravel-auth Laravel Fortify Laravel Breeze tymon/jwt-auth
API-only (no Blade/Inertia) ✅ ✅ ❌ ✅
OTP email verification ✅ ❌ ❌ ❌
Magic link verification ✅ ❌ ❌ ❌
Sliding refresh tokens + reuse detection ✅ ❌ ❌ ❌
Multi-session management ✅ ❌ ❌ ❌
Permanent device history ✅ ❌ ❌ ❌
Google OAuth out of the box ✅ ❌ ✅ (Blade only) ❌
Long-lived API tokens ✅ ❌ ❌ ❌
Account suspend / ban / delete workflow ✅ ❌ ❌ ❌
Referral codes with anti-abuse detection ✅ ❌ ❌ ❌
Config-driven (zero code required) ✅ Partial ❌ ❌
SPA cookie + mobile Bearer token ✅ Partial ❌ ❌
Localization (all messages translatable) ✅ ✅ ✅ ❌
Custom JSON response format ✅ ❌ ❌ ❌

vs. Laravel Fortify — Fortify is headless but provides only the basics (login, register, password reset, two-factor). It has no refresh tokens, no device tracking, no API token management, and no referral system. You still write all the controller logic.

vs. Laravel Breeze / Jetstream — These are scaffolding tools that generate Blade or Inertia views. They are not suitable for pure API apps or mobile backends.

vs. tymon/jwt-auth — jwt-auth only handles JWT issuance. It has no registration flow, no email verification, no session management, and no account lifecycle features.

FAQ

Q: Does this work with mobile apps (iOS / Android)? Yes. The package supports Bearer token auth (Authorization: Bearer <token>) for mobile clients and SPA cookie auth for browser-based apps. All endpoints return JSON with no Blade rendering.

Q: Can I use this with an existing User model? Yes. The package adds traits to your existing model and runs its own migrations alongside yours. Your users table is not replaced.

Q: Does it work with Laravel Octane / Swoole? Yes. Services never store $request on singleton instances. All request state is passed as method arguments.

Q: What happens if I disable a feature I don't need? Each major feature (referral codes, Google OAuth, API tokens, account deletion) is individually toggle-able via config or .env. Disabled features return 404 or are simply not mounted.

Q: Can I customize the JSON response format? Yes. Implement ResponseFormatterContract and bind it in your AppServiceProvider (or set auth_system.response.formatter in config). Every response goes through your formatter.

Q: How does OTP verification work? After POST /auth/register, the package sends a 6-digit OTP code to the user's email (and optionally a magic link). The OTP is stored in Redis with a configurable TTL. On POST /auth/register/verify-otp, the code is validated and a completion_token is returned for the final registration step.

Q: How are refresh tokens protected against theft? Refresh tokens use family-based rotation. Each refresh issues a new token and invalidates the old one. If a stolen token is used after it has already been rotated, the entire token family is revoked — logging out all sessions for that family.

Q: How does the referral anti-abuse detection work? On redemption, the package compares the referrer's device history (stored permanently in auth_user_devices) against the new user's IP and browser/device fingerprint. Even if the referrer logs out before the referral is submitted, the historical device record is still checked. The policy (block / flag / ignore) is configurable per signal (same IP, same device, both).

Q: What PHP and Laravel versions are supported? PHP ^8.2 and Laravel ^12.0 or ^13.0.

Q: Can I translate error and success messages? Yes. Run php artisan vendor:publish --tag=auth-lang to publish translation files. See docs/localization.md.

Q: Is there a rate limiting feature? Yes. Login, registration, OTP verification, and password reset endpoints all have configurable rate limits. On lockout, the response includes a retry_after field.

Documentation

Document What it covers
Installation Setup, auth:install, manual install, troubleshooting
Configuration Every config key and .env variable
Customization Extra fields, transformers, OTP channel, custom phone driver, response format, email templates, all contracts
Middleware Every middleware alias, what it does, where to apply it, ordering, required Laravel built-ins
Events All lifecycle events, payloads, listeners, queueing
Localization Multi-language messages, translation files, all message keys
Account Status Status workflow, auth.active middleware, timed bans, audit log
Account Deletion Self-delete, grace period, auto-restore, purge worker
Referral Codes Referral codes, fingerprint anti-abuse, reward handlers, web + mobile integration
Upgrading Version changelog, breaking changes, migration guides
AI Context Full repo snapshot for AI assistants

Changelog

See docs/upgrading.md for the full version history, breaking changes, and migration guides between releases.

Contributing & Discussions

License

MIT. See LICENSE.

Structured Metadata

JSON-LD: SoftwareSourceCode schema
JSON-LD: FAQ schema
Suggested GitHub repository topics Set these in your repository **Settings → Topics**.

All versions of laravel-auth with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
laravel/framework Version ^12.0|^13.0
laravel/sanctum Version ^4.0
laravel/socialite Version ^5.0
spatie/laravel-permission Version ^6.0
jenssegers/agent Version ^2.6
pragmarx/google2fa Version ^8.0
bacon/bacon-qr-code Version ^3.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package joe-404/laravel-auth contains the following files

Loading the files please wait ...