PHPackages exceed/exauth - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. exceed/exauth ActiveLibrary[Authentication & Authorization](/categories/authentication) exceed/exauth ============= Extended Authentication for CodeIgniter 4 — Shield's multi-auth stack with Myth-Auth's database-driven groups & permissions v1.5.3(1mo ago)037↓75%1MITPHPPHP ^8.2 Since Jul 15Pushed 1mo agoCompare [ Source](https://github.com/ExceedRepo/exAuth)[ Packagist](https://packagist.org/packages/exceed/exauth)[ Docs](https://github.com/ExceedRepo/exAuth)[ RSS](/packages/exceed-exauth/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependencies (8)Versions (18)Used By (1) exAuth — Extended Authentication for CodeIgniter 4 ================================================== [](#exauth--extended-authentication-for-codeigniter-4) [![](https://github.com/exauth/exauth/workflows/PHPUnit/badge.svg)](https://github.com/exauth/exauth/actions/workflows/phpunit.yml)[![](https://github.com/exauth/exauth/workflows/PHPStan/badge.svg)](https://github.com/exauth/exauth/actions/workflows/phpstan.yml)[![](https://github.com/exauth/exauth/workflows/StructArmed/badge.svg)](https://github.com/exauth/exauth/actions/workflows/structarmed.yml)[![Coverage Status](https://camo.githubusercontent.com/769b517a0912ccd2e1df6e15e70fe90b14213d9c07d1da2cfa31482e6af44006/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f6578617574682f6578617574682f62616467652e7376673f6272616e63683d6d61696e)](https://coveralls.io/github/exauth/exauth?branch=main) exAuth is an authentication and authorization library for CodeIgniter 4, created for developers who want the modern multi-authentication power of **CodeIgniter Shield** (Session, Tokens, HMAC, JWT, ChainAuth) but prefer the simplicity of **Myth/Auth**'s approach — where groups and permissions are managed **in the database**, not hardcoded in config files. Instead of editing a PHP config file every time you need a new role or permission, exAuth stores everything in database tables (`auth_groups_users`, `auth_permissions_users`) so you can manage them dynamically at runtime, just like Myth/Auth. Project Notice -------------- [](#project-notice) exAuth was built as a learning/analysis project bringing together the best of CodeIgniter Shield and Myth/Auth. **Shield** is the official, maintained authentication library for CodeIgniter 4. **Myth/Auth** is the predecessor of Shield, now archived. exAuth is not an official package. For production, the recommended library is [CodeIgniter Shield](https://github.com/codeigniter4/shield). Requirements ------------ [](#requirements) - PHP 8.2+ - CodeIgniter 4.3+ Features -------- [](#features) - **4 Authentication Methods**: Session, AccessTokens, HmacSha256, JWT - **Chain Authentication** — tries multiple authenticators in sequence until one succeeds - **Database-backed Groups & Permissions** (simple, Myth-Auth style) - **Flat RBAC** per NIST standards - **Wildcard Permission Matching** (e.g. `admin.*`) - **Remember-me** persistent login - **Magic Link** passwordless login via email - **2FA-ready** — action-based post-authentication system - **Email-based account verification** - **User Activation/Banning** (Activatable, Bannable traits) - **All views** for login, registration, forgot password flows - **CLI commands** for easy setup and management - **Debug Toolbar** integration - **22-language support** structure (English + Indonesian built-in) ### New in v1.5.0 [](#new-in-v150) - **Cache RBAC** — groups & permissions cached 5 minutes (auto-invalidated on group/permission change). - **Auto-Installer Wizard** — `exauth:setup` interactive prompts for registration, authenticator, JWT/Tokens/HMAC, rate limiting. - **Rate Limiting** — brute-force throttling on login (config `enableRateLimit`, `maxLoginAttempts`, `loginAttemptHours`). - **Configurable registration** — `allowRegistration = false` now disables the register route and hides the "Register" link. - **Social login (Google)** — available as a separate package [`exceed/exauth-oauth`](https://github.com/ExceedRepo/exauth-oauth) (Google-only in phase 1). Installation ------------ [](#installation) ### Composer [](#composer) ``` > composer require exauth/exauth ``` ### Manual [](#manual) Clone or download the repo and add the namespace to **app/Config/Autoload.php**: ``` $psr4 = [ 'exAuth' => APPPATH . 'ThirdParty/exauth/src', ]; ``` Configuration ------------- [](#configuration) > **New to exAuth?** Follow the step-by-step [Beginner Setup Guide](docs/EXAUTH_BEGINNER_SETUP.md) — it takes you from zero to a working login/register/logout flow (and RBAC). Building an API? See the [Beginner JWT Setup guide](docs/EXAUTH_BEGINNER_JWT_SETUP.md)or the [Access Tokens & HMAC guide](docs/EXAUTH_BEGINNER_TOKENS_HMAC_SETUP.md). The fastest way to configure everything is the setup command: ``` php spark exauth:setup ``` This publishes config, registers the `exAuth` helper, adds the auth routes, adjusts CSRF settings, and runs migrations. To do it manually, see the [Beginner Setup Guide](docs/EXAUTH_BEGINNER_SETUP.md#5b-manual-setup-only-if-the-command-fails). Overview -------- [](#overview) When installed, exAuth provides basic authentication: user registration, login/logout, forgotten password, magic-link login, and route protection via filters. Routes are registered by adding this line to **app/Config/Routes.php**: ``` service('auth')->routes($routes); ``` ### Views [](#views) Default views live in `src/Views` and are based on Bootstrap 5. To customize them, copy the files into your app's `Views` directory and adjust the `view(...)` calls, or override the paths in `Config/exAuth.php`. ### Login field (email / username / both) [](#login-field-email--username--both) Like Shield and Myth-Auth, exAuth lets you choose which field users log in with. Configure it in **Config/exAuth.php**: ``` public array $validFields = ['email', 'username']; public bool $useEmailForLogin = true; public bool $useUsernameForLogin = true; ``` - Both `true` (default): the login form accepts **either** an email or a username in a single field. The controller auto-detects which one was entered. - Only email: set `$useUsernameForLogin = false`. - Only username: set `$useEmailForLogin = false`. The login view submits a single `login` input; `LoginController::loginPost()`reads the config and resolves the user accordingly. Services -------- [](#services) **auth** Provides access to the exAuth facade. Its main job is registering routes: ``` // app/Config/Routes.php service('auth')->routes($routes); ``` For login state and the current user, use the helper functions below (`ex_logged_in()`, `ex_current_user()`, etc.). Helper Functions ---------------- [](#helper-functions) exAuth comes with its own helper. Load it with `helper('exAuth');`. > **Hint**: Add `'exAuth'` to the `$helpers` property of **BaseController.php** to have it globally available. The auth filters all pre-load this helper on filtered routes. **ex\_auth()** Returns the authentication service instance (factory). ``` ex_auth() ``` **ex\_logged\_in()** Checks if any user is logged in. Returns `true` or `false`. ``` ex_logged_in() ``` **ex\_current\_user()** Returns the User entity for the current logged in user, or `null`. ``` ex_current_user() ``` **ex\_user\_id()** Returns the current user's integer ID, or `null`. ``` ex_user_id() ``` **ex\_logout()** Logs out the current user. ``` ex_logout() ``` Users ----- [](#users) exAuth uses CodeIgniter Entities for the User object. User accounts live in the `users` table (email, username, password, active, status, etc.). Assign a user to a group by inserting into the `auth_groups_users` table (the group name is stored as text), or use the CLI: ``` php spark exauth:user addgroup -n johndoe -g admin ``` Restricting by Route -------------------- [](#restricting-by-route) ### Filter Aliases [](#filter-aliases) Filters are auto-registered via the `Registrar` pattern. You do **not** need to add them to `Config/Filters.php` manually. Available filter aliases: ``` 'session' => Session-based auth (redirect to /login if not logged in) 'tokens' => Bearer token auth (returns 401 JSON on failure) 'hmac' => HMAC signature auth (returns 401 JSON on failure) 'jwt' => JWT Bearer token auth (returns 401 JSON on failure) 'chain' => Tries session, tokens, jwt, hmac in sequence 'group' => Checks group membership 'permission' => Checks permissions ``` ### Global Restrictions [](#global-restrictions) Restrict by URI pattern in **app/Config/Filters.php**: ``` public $filters = [ 'login' => ['before' => ['account/*']], ]; ``` Or globally: ``` public $globals = [ 'before' => [ 'honeypot', 'login', ... ], ]; ``` ### Single Route [](#single-route) ``` $routes->get('admin/users', 'UserController::index', ['filter' => 'permission:users.manage']); $routes->get('admin/users', 'UserController::index', ['filter' => 'group:admin,superadmin']); ``` ### Route Groups [](#route-groups) ``` $routes->group('admin', ['filter' => 'group:admin,superadmin'], function($routes) { ... }); ``` ### Chain Authentication Filter [](#chain-authentication-filter) Use the chain filter to try multiple authenticators in sequence: ``` $routes->get('api/profile', 'Profile::index', ['filter' => 'chain:session,tokens,jwt']); ``` Customization ------------- [](#customization) See the [Extending](docs/extending.md) documentation. Credits ------- [](#credits) Built from the best of two worlds: the **Shield Foundation** (CodeIgniter Shield) and the **Myth-Auth** community. ### Health Score 43 — FairBetter than 89% of packages Maintenance91 Actively maintained with recent releases Popularity9 Limited adoption so far Community8 Small or concentrated contributor base Maturity55 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 17 Last Release 43d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/c2c298f1aca735d0942190f97d02d410fda45527ebd19d7e3fe27a925458ef7e?d=identicon)[radipermanasuherman](/maintainers/radipermanasuherman) --- Top Contributors [![radipermanasuherman-creator](https://avatars.githubusercontent.com/u/305285510?v=4)](https://github.com/radipermanasuherman-creator "radipermanasuherman-creator (23 commits)") --- Tags Authenticationcodeigniterauthorizationcodeigniter4shieldmyth-authexauth ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/exceed-exauth/health.svg) ``` [![Health](https://phpackages.com/badges/exceed-exauth/health.svg)](https://phpackages.com/packages/exceed-exauth) ``` ### Alternatives [google/auth Google Auth Library for PHP 1.4k310.1M255](/packages/google-auth)[codeigniter4/shield Authentication and Authorization for CodeIgniter 4 423506.7k31](/packages/codeigniter4-shield)[ellaisys/aws-cognito Laravel authentication with AWS Cognito, supporting web, API, SSO, MFA, WebAuthn, passkeys, and passwordless authentication. 122284.0k1](/packages/ellaisys-aws-cognito)[agungsugiarto/boilerplate CodeIgniter4 Boilerplate based on AdminLTE 3 with user management, roles, permissions, ... 1648.1k](/packages/agungsugiarto-boilerplate)[kinde-oss/kinde-auth-php Kinde PHP SDK for authentication 22100.1k3](/packages/kinde-oss-kinde-auth-php) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)