Download the PHP package padosoft/laravel-rebel-auth without Composer

Laravel Rebel — Enterprise Authentication, the way Shopify wishes it did it

Official documentation: https://doc.laravel-rebel.padosoft.com

Passwordless, passkey-first, risk-based authentication for Laravel — a control plane over Fortify. Email-OTP & passkey login (web + mobile via Sanctum), risk-based step-up with PSD2/SCA dynamic linking, multi-channel verification with anti toll-fraud, refresh-token rotation with reuse detection, device trust, recovery codes, anomaly detection with an advisory AI, a web admin panel, and NIST/PSD2/GDPR-aware compliance — modular, multi-tenant, and PHPStan-max across the board.

Table of contents

• What Laravel Rebel is
• Rebel vs Shopify vs the rest — the card-battle
• The package map
• Dependency DAG
• What you can do, end to end
• Narrated flows
• Web Admin Panel
• Install
• Compliance
• Quality bar
• License

What Laravel Rebel is

Rebel is the control plane for authentication. Laravel Fortify gives you the plumbing (login, 2FA enrolment, passkeys); Rebel adds the policy, intelligence and operations on top:

• Passwordless & passkey-first login — email-OTP and WebAuthn, for web and mobile (Laravel Sanctum access + refresh tokens).
• Risk-based step-up — require the right strength (NIST AAL/AMR) per action, with PSD2/SCA dynamic linking for payments.
• Multi-channel verification — SMS/WhatsApp/voice through pluggable providers (Twilio…), with anti toll-fraud/IRSF defences and provider fallback.
• Session security — refresh-token rotation with reuse detection, logout-everywhere, device trust.
• Recovery — single-use, HMAC-hashed backup codes.
• Intelligence — deterministic anomaly detection + an AI that explains, never decides.
• Operations — a permission-gated, tenant-aware admin API + a web panel.

Every piece is its own composer package: take only what you need, or the whole suite via this meta-package.

Rebel vs Shopify vs the rest — the card-battle

How Rebel's auth stacks up against Shopify's customer auth, Laravel Fortify alone, and Sanctum/Passport tokens:

Legend: ✅ built-in · ➖ partial / hosted-only / DIY · ❌ not available · n/a closed-source. Shopify is a great hosted product — but it's a black box you don't control or extend. Rebel gives you the same capabilities (and several Shopify doesn't have, like PSD2/SCA dynamic linking and refresh-token reuse detection) in your own Laravel app, self-hosted, auditable, and multi-tenant.

The package map

Dependency DAG

Install order follows the arrows: core first, then the leaves; channel-twilio after channels; admin after admin-api.

What you can do, end to end

• Log a customer in without a password — email -> OTP -> access + refresh token (mobile) or session (web); or passkey-first with email-OTP fallback.
• Force a strong re-auth before a risky action — "this checkout needs a phishing-resistant passkey", bound to the exact amount + payee (PSD2/SCA).
• Send verifications safely — across SMS/WhatsApp/voice with provider fallback, geo allowlist and per-prefix circuit breaker so toll-fraud can't drain your budget.
• Detect token theft — a replayed refresh token burns the whole session.
• Recover lost access — single-use backup codes behind a high-assurance step-up.
• See and explain what's happening — a tenant-aware admin panel with metrics, funnels and an audit explorer, plus deterministic anomaly cases an AI can narrate.

Narrated flows

1) Customer passwordless login (mobile)

2) Checkout of a credit order (PSD2/SCA)

3) Account recovery

Web Admin Panel

A security-operations dashboard (laravel-rebel-admin) sits on top of the admin API: security overview, OTP/step-up funnels, channel performance, provider health, audit explorer, device & session trust, risk rules, anomaly cases, an AI copilot, and a compliance center — light/dark, tenant-aware, fail-closed.

Install

Install the whole suite via this meta-package:

…or cherry-pick the packages you need (each has its own quick-start README). Optional channel providers and bridges are listed under suggest — e.g. add Twilio:

Then publish migrations/config from the packages you use and run php artisan migrate. Each package's README has a junior-proof, copy-paste quick start.

Compliance

• NIST 800-63B: explicit AAL/AMR on every factor; passkeys are phishing-resistant; step-up enforces the required assurance and decays it on policy change.
• PSD2/SCA: dynamic linking binds a strong confirmation to amount + payee; the binding is a keyed HMAC with key rotation.
• GDPR: identifiers and IPs are stored as keyed HMACs (never plaintext); audit metadata is sanitized; AI prompts are scrubbed of PII/secrets.

Quality bar

Every package in the suite ships with: PHPStan level max, Pest tests, Pint code style, a CI matrix across PHP 8.3 / 8.4 / 8.5 × Laravel 12 / 13, a didactic README with a competitor comparison, and a full local + dual-bot (Codex + Copilot) review on every release.

🔋 Vibe coding with batteries included

Every package in the suite ships AI batteries — so you (and your AI agent) extend it correctly on the first try:

• CLAUDE.md — a concise AI working guide (purpose, conventions, architecture, how to extend, Definition of Done). Plain Markdown, so Claude Code, Cursor, Copilot and Codex all read it.
• AGENTS.md — the agent/workflow contract (branch → PR → CI → tag/release, the gates).
• .claude/skills/rebel-package-dev — an invocable skill encoding the suite's TDD loop, the PHPStan-level-max recipes, the security/telemetry rules, and the release discipline.

Open any repo in your AI editor and just start — the rules, guardrails and extension recipes come with it. The source-of-truth templates + the rollout plan live in docs/ai-batteries/.

License

MIT — see Padosoft.