Separate Admin authenticatable model with its own guard, provider, password broker, migration, factory and observer for Laravel.

Base authenticatable User model, migration, factory and observer shared by the jeffersongoncalves Laravel starter kits.

Connexion Keycloak (SSO) pour une SPA avec une API Laravel : jeton Sanctum, rôles, déconnexion depuis Keycloak (back-channel logout) et après inactivité.

SSO client for Laravel: Authorization Code + PKCE login, RS256/JWKS or signed userinfo token validation, user sync and back-channel Single Logout.

Admin-panel-agnostic core for forcing two-factor authentication in any Laravel app: a shared bypass registry (compose several "skip 2FA" reasons) that the nova-force-two-factor and filament-force-two-factor adapters enforce.

Framework-agnostic Okta SSO for Laravel: the Socialite Okta driver, login/callback/logout flow, lifecycle hooks and a pluggable panel seam that the nova-okta and filament-okta adapters build on.

Truecaller OAuth 2.0 (SDK 3.x) server-side login for Laravel

Native CAS Authentication package for Laravel.

Extensible Laravel authentication package providing actions for login, logout, sign-up, password reset, email verification and related security features.

Laravel integration for Sign in with Hytale

Multi-Factor Authentication package for Laravel with TOTP, Email OTP, and WebAuthn support

Production-ready, OWASP-hardened Laravel authentication scaffolding with 2FA (TOTP), Dashboard, User Profile, and 5 distinct Blade & Tailwind CSS themes. Zero-build instant setup. Created by Arindam Makar.

Standalone API key authentication for Laravel: SHA-256 hashed keys, read/write scopes, per-key permissions, lifecycle events, and an authentication middleware.

Laravel identity package for users, teams, roles, and permissions, with JWT authentication via waventra/laravel-jwt-token.

Secure JWT authentication for Laravel with rotating refresh tokens, reuse detection, and revocation.

Developer API key management (prefix-routed keys, rotation with overlap, per-key rate limits, async usage tracking) for Laravel. Works standalone and auto-wires into mrsuner/laravel-api-boilerplate.

A Bootstrap 5 and Blade authentication starter package for Laravel.

Production-grade, modular, portable, and secure authentication package for Laravel applications.

A one-click development login page for Laravel, with named profiles that authenticate through your own guards and can carry a tenant.

Laravel Sanctum authentication APIs with OTP verification, soft deletes, and JSON-driven RBAC.

Laravel package for trusted-device login approval and device-approval security workflows.

Composer composition of all NVL Laravel Suite packages

Security-first Cloudflare Access (Zero Trust) authentication for Laravel

Automatic login activity tracking, device fingerprinting, and new-device alerts for Laravel applications.

Official Laravel SDK for GeniusAuth OpenID Connect authentication.

Laravel integration for PulseProof Sentinel Protocol (PPS).

Stateless contextual authentication primitives (Identity, Principal, Device, Tenant) for Laravel 12 and 13.

Authentication integrations for Laravel: Google OAuth2 and provider-based CAPTCHA verification (Cloudflare Turnstile, Google reCAPTCHA v3).

Transparently upgrade legacy password hashes (MD5/SHA1/salted) to bcrypt the first time a user signs in.

Laravel/PHP consumer SDK for Cbox ID — turnkey OIDC login, hosted profile-management redirect, machine tokens, and webhook verification against a Cbox ID instance.

Prefixed, hashed API keys with scope-to-permission mapping for multi-tenant Laravel APIs.

Reusable, Sanctum-based authentication for Laravel — registration, login, password reset, TOTP two-factor, invitations, and social login — built with hexagonal ports & adapters.

Modern user impersonation for Laravel — securely log in as another user for admin and support workflows.

Starter-ready Laravel authentication kit — Blade UI, Sanctum API, OTP, multi-vendor roles, and email/phone verification.

Multi-tenant SSO package for Laravel supporting OIDC and SAML 2.0 with provisioning, multiple guards, and optional Inertia admin UI.

Securely assume another user's identity in modern Laravel applications.

Byte Federal's fast authentication system built on bitcoin cryptographic standards for Laravel applications.

Passwordless email magic-link & OTP authentication for Laravel — standalone, or with Fortify so that a user with 2FA reaches the challenge before any session exists, and with scanner-safe link consumption.

Demo / integration application for the padosoft/laravel-rebel-* enterprise authentication suite.

Bring-your-own-IdP OAuth 2.1 resource server for the official laravel/mcp package: external token validation (JWT/JWKS + RFC 7662 introspection), RFC 8707 audience binding, scope enforcement, and RFC 9728 discovery.

My fork of leandrose/laravel-keycloak-guard.

Laravel roles and permission system

Bridge the benbjurstrom/otpz email one-time-password package into Laravel Rebel step-up. Exposes OTP email magic-code as a step-up driver (AAL2, AMR otp). Part of padosoft/laravel-rebel-*.

WebAuthn passkey step-up driver for Laravel Rebel: bridges spatie/laravel-passkeys into Rebel's step-up registry, issuing phishing-resistant AAL3 challenges.

Bridge between spatie/laravel-one-time-passwords and Laravel Rebel: exposes email/SMS OTP as an AAL2 step-up driver with full audit telemetry. Part of padosoft/laravel-rebel-*.

Bridge between laragear/two-factor and Laravel Rebel: exposes TOTP as an AAL2 step-up driver, integrates recovery codes, and emits full audit telemetry into the Rebel audit trail. Part of padosoft/laravel-rebel-*.

Discord delivery channel for Laravel Rebel Channels: ship security/SOC alerts (anomaly cases, lockouts, high-risk events) and notifications to a Discord channel via webhook. Part of padosoft/laravel-rebel-*.

Telegram bot delivery channel for Laravel Rebel Channels: deliver OTP codes and security alerts to a Telegram chat. Part of padosoft/laravel-rebel-*.

Bird (formerly MessageBird) provider for Laravel Rebel Channels: phone verification via the Bird Verify API (SMS), plain SMS delivery, and signed delivery-status webhooks. Part of padosoft/laravel-rebel-*.

Pluggable anti-bot / CAPTCHA gate for Laravel Rebel: server-side verification of Cloudflare Turnstile, Google reCAPTCHA v3 and hCaptcha tokens, fail-closed by default and fully audited. Part of padosoft/laravel-rebel-*.