Download the PHP package laravel/passkeys without Composer

Laravel Passkeys

Passwordless authentication using WebAuthn/passkeys for Laravel.

Installation

Publish and run the migrations:

Optionally publish the config file:

Add the PasskeyAuthenticatable trait to your User model and implement the PasskeyUser contract:

The trait assumes a standard users schema with name and email columns, which authenticators show in their UI during registration and account selection. displayName falls back from name to email to the auth identifier, and username falls back from email to the auth identifier — override getPasskeyDisplayName() and getPasskeyUsername() if you want different values.

If you want to use custom models, override them in a service provider:

JavaScript Client

This package is designed to work with the @laravel/passkeys npm package:

Routes

The package automatically registers the following routes:

Guest Routes (Login)

• GET /passkeys/login/options - Get login options
• POST /passkeys/login - Verify passkey and authenticate

Authenticated Routes (Confirmation)

• GET /passkeys/confirm/options - Get confirmation options
• POST /passkeys/confirm - Confirm password via passkey

Authenticated Routes (Management)

• GET /user/passkeys/options - Get registration options
• POST /user/passkeys - Store new passkey
• DELETE /user/passkeys/{passkey} - Delete passkey

Configuration

Events

The package fires the following events:

• PasskeyRegistered - When a new passkey is registered
• PasskeyVerified - When a user verifies with a passkey
• PasskeyDeleted - When a passkey is deleted

Customization

Login Authorization Callback

You may block login after a valid passkey assertion (for example, suspended/banned accounts):

Return false to stop authentication, or throw your own ValidationException for a custom error message.

User-Bound Verification (Reauth / 2FA Step)

Use GenerateVerificationOptions with an authenticated user to scope allowed credentials to that user, then pass the same user into VerifyPasskey to enforce ownership:

This verifies the passkey without logging the user in again, which is useful for sensitive-action confirmation flows.

Custom Actions

Actions handle the core WebAuthn logic. Extend an action and bind it in your service provider:

Available actions:

• GenerateRegistrationOptions
• GenerateVerificationOptions
• StorePasskey
• VerifyPasskey
• DeletePasskey

Custom Responses

Bind your own response classes to customize what happens after passkey operations:

Available response contracts:

• PasskeyLoginResponse - After successful login
• PasskeyConfirmationResponse - After successful confirmation
• PasskeyRegistrationResponse - After successful registration
• PasskeyDeletedResponse - After passkey deletion

Custom Passkey Model

Extend the base model:

Disable Routes

To register your own routes:

Testing

License

The MIT License (MIT). Please see License File for more information.