Multifactor Passkeys

• Compatibility
• Installation
• Usage
  • 1. Prepare your User model
  • 2. Register the MFA provider in your panel
  • 3. Customising the redirect URL
• How it works
• Development
• Changelog
• Contributing
• Security Vulnerabilities
• Credits
• License

Multi-factor authentication for Filament panels using WebAuthn passkeys, powered by spatie/laravel-passkeys.

#Compatibility

#Installation

Install the package via composer:

composer require jeffersongoncalves/filament-multifactor-passkeys

Publish and run the migrations from spatie/laravel-passkeys:

php artisan vendor:publish --tag="passkeys-migrations"
php artisan migrate

Publish the spatie/laravel-passkeys config (optional, to tweak relying party, allowed origins, etc.):

php artisan vendor:publish --tag="passkeys-config"

Publish this package's config (optional):

php artisan vendor:publish --tag="filament-multifactor-passkeys-config"

#Usage

#1. Prepare your User model

Add the Spatie InteractsWithPasskeys trait and implement the package's HasPasskeyAuthentication contract (which extends Spatie's HasPasskeys interface):

use Filament\Models\Contracts\FilamentUser;
use Illuminate\Foundation\Auth\User as Authenticatable;
use JeffersonGoncalves\Filament\MultiFactorPasskeys\Contracts\HasPasskeyAuthentication;
use Spatie\LaravelPasskeys\Models\Concerns\InteractsWithPasskeys;

class User extends Authenticatable implements FilamentUser, HasPasskeyAuthentication
{
    use InteractsWithPasskeys;

    public function hasPasskeyAuthentication(): bool
    {
        return $this->passkeys()->exists();
    }

    // ...
}

#2. Register the MFA provider in your panel

In your PanelProvider, register PasskeyAuthentication in the multiFactorAuthentication() array. To also expose a "Sign in with a passkey" button on the login screen, register the plugin as well:

use Filament\Panel;
use JeffersonGoncalves\Filament\MultiFactorPasskeys\MultiFactorPasskeysPlugin;
use JeffersonGoncalves\Filament\MultiFactorPasskeys\PasskeyAuthentication;

public function panel(Panel $panel): Panel
{
    return $panel
        // ...
        ->multiFactorAuthentication([
            PasskeyAuthentication::make(),
        ])
        ->plugin(MultiFactorPasskeysPlugin::make());
}

That's it. The MFA section in the user profile page now shows a "Passkey verification" entry with Set up / Turn off buttons. The plugin also injects a passkey login button after the standard login form, allowing users to authenticate without typing email/password. After registering a passkey, the next login can use it directly.

The package auto-registers Spatie's Route::passkeys() macro (under the web middleware group) so the login button works out of the box. If you've already registered them yourself, the auto-registration is skipped.

#3. Customising the redirect URL

By default, after a successful registration or assertion the user is redirected to the current panel home (Filament::getCurrentPanel()->getUrl()). To override:

PasskeyAuthentication::make()
    ->redirectUrlUsing(fn () => route('dashboard'));

You can also set a static URL via config/filament-multifactor-passkeys.php:

return [
    'redirect' => '/dashboard',
];

#How it works

This package is a thin Filament adapter on top of spatie/laravel-passkeys. The WebAuthn ceremony (challenge generation, browser API, attestation/assertion verification, persistence) is fully handled by Spatie's package and its Blade components (<x-create-passkey> and <x-authenticate-passkey>), which are embedded inside Filament modals and the MFA challenge schema.

• Set up opens a Filament modal that renders <x-create-passkey :redirect="..." />
• Disable removes all of the user's passkeys via $user->passkeys()->delete()
• Login challenge renders <x-authenticate-passkey :redirect="..." />

#Development

# Static analysis
composer analyse

# Code style
composer format

# Tests
composer test

#Changelog

Please see CHANGELOG for more information on what has changed recently.

#Contributing

Please see CONTRIBUTING for details.

#Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

#Credits

• Jefferson Gonçalves
• Spatie — for the underlying WebAuthn implementation
• All Contributors

#License

The MIT License (MIT). Please see License File for more information.