Download the PHP package spykapps/passwordless-login without Composer

On this page you can find all versions of the php package spykapps/passwordless-login. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of spykapps/passwordless-login

Informations about the package passwordless-login

Packagist Version Total Downloads Laravel 13 PHP 8.3 License

Passwordless Login for Laravel

A highly customizable, multilingual magic link authentication package for Laravel with bot/prefetch detection, rate limiting, conditional auth, and a comprehensive event system.

Features

Requirements

Installation

Publish Config

Publish & Run Migrations

Publish Everything (optional)

This publishes config, migrations, views, and language files.

Upgrading from a Previous Version

If you already have the package installed and a passwordless_login_tokens table in your database, run the upgrade command to apply new schema changes introduced in this version (such as the failure_url column):

The command will:

  1. Ask for your tokens table name (defaults to passwordless_login_tokens, or whatever is set in your config)
  2. Show a disclaimer listing every column it intends to add
  3. Ask for confirmation before touching your database
  4. Add any missing columns — safely skipping columns that already exist

The upgrade command is non-destructive and idempotent — it only adds new nullable columns and is safe to run multiple times.

Quick Start

1. Add the Trait to Your User Model

2. Send a Magic Link

3. That's It!

The package automatically:

Usage Examples

Basic Usage

Fluent Builder (Full Customization)

Using the Trait

Get URL Without Sending Email

Possible ways to generate URLs

Configuration

All options in config/passwordless-login.php:

Option Default Description
user_model App\Models\User The authenticatable model
email_column email Column used to find users by email
guard null (default) Authentication guard
remember false Remember me flag
token.length 32 Token byte length (16–128)
token.hash_algorithm sha256 sha256, bcrypt, or argon2
expiry_minutes 15 Minutes until link expires
max_uses 1 Max times a link can be used (null = unlimited)
route.path /magic-login/{token} The magic link route path
route.name passwordless.login Route name
route.middleware ['web', 'guest'] Route middleware
route.prefix '' Route prefix
redirect.on_success /dashboard Redirect after login
redirect.on_failure /login Redirect on failure
throttle.enabled true Rate limiting
throttle.max_attempts 5 Max links per decay period
throttle.decay_minutes 10 Rate limit window
bot_detection.enabled true Bot/prefetch detection
bot_detection.strategy both confirmation_page, javascript, or both
notification.enabled true Auto-send email
notification.queue false Queue the notification
notification.class built-in Custom notification class
notification.mailable null Use a Mailable instead
conditions [] Callables/classes that must return true
after_login_action null Action to run after login
table passwordless_login_tokens Database table name
security.invalidate_previous true Invalidate old tokens on new generate
security.invalidate_on_login true Invalidate all tokens after login
security.ip_binding false Bind link to requester's IP
security.user_agent_binding false Bind link to requester's UA
security.audit_log true Log all activity

Bot/Prefetch Detection

Email clients like Outlook, Apple Mail, and security scanners like SafeLinks and Barracuda often visit links before the user clicks them. This can consume one-time magic links.

How It Works

The package uses a multi-layered detection approach:

  1. User-Agent Detection — Matches known bot/scanner patterns
  2. HTTP Method Detection — Bots often use HEAD/OPTIONS requests
  3. Prefetch Header Detection — Checks X-Purpose, Sec-Purpose, Sec-Fetch-Dest headers
  4. Suspicious Header Analysis — Flags requests without browser-typical headers

Strategies

Conditional Authentication

Restrict who can log in with custom conditions:

Custom Condition Class

After Login Actions

Run custom code after successful authentication:

Events

Event Dispatched When Payload
MagicLinkGenerated Link is created $user, $token, $url, $ipAddress
MagicLinkSent Notification/email sent $user, $channel
MagicLinkClicked Link URL is visited $tokenModel, $request, $isBotDetected
MagicLinkAuthenticated User successfully logged in $user, $request, $guard
MagicLinkFailed Authentication failed $reason, $request, $token, $ipAddress
MagicLinkExpired Expired link accessed $tokenModel, $request
MagicLinkUsed Token use count incremented $tokenModel, $request
MagicLinkThrottled Rate limit exceeded $user, $availableInSeconds
BotDetected Bot/prefetch detected $request, $reason, $token

Listening to Events

Multilingual Support

Publish the language files:

This creates lang/vendor/passwordless-login/en/messages.php. Add translations by creating new locale folders (e.g. es/messages.php, fr/messages.php, de/messages.php).

Example: Spanish Translation

Custom Notification / Mailable

Custom Notification

Your notification receives: $url, $expiryMinutes, $metadata.

Custom Mailable

Your mailable receives: $url, $expiryMinutes in the constructor.

Custom Views

Publish and customize views:

Published to resources/views/vendor/passwordless-login/:

API / JSON Support

The controller automatically returns JSON when Accept: application/json is sent:

Success:

Failure:

Security Best Practices

  1. Don't reveal user existence — Use link_sent_if_exists message
  2. Keep expiry short — 15 minutes is a good default
  3. Use one-time links — Set max_uses to 1
  4. Enable invalidate_previous — Only the latest link works
  5. Enable invalidate_on_login — All links consumed after login
  6. Consider IP binding for high-security applications

Credits

License

The MIT License (MIT). Please see License File for more information.

All versions of passwordless-login with dependencies

PHP Build Version
Package Version
Requires php Version ^8.1
illuminate/contracts Version ^10.0|^11.0|^12.0|^13.0
illuminate/database Version ^10.0|^11.0|^12.0|^13.0
illuminate/http Version ^10.0|^11.0|^12.0|^13.0
illuminate/mail Version ^10.0|^11.0|^12.0|^13.0
illuminate/notifications Version ^10.0|^11.0|^12.0|^13.0
illuminate/routing Version ^10.0|^11.0|^12.0|^13.0
illuminate/support Version ^10.0|^11.0|^12.0|^13.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package spykapps/passwordless-login contains the following files

Loading the files please wait ...