PHPackages                             hamzi/vaultic - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. hamzi/vaultic

ActiveLibrary[Authentication & Authorization](/categories/authentication)

hamzi/vaultic
=============

Vaultic v4.0 - Laravel 13 WebAuthn/Passkeys authentication package.

v4.2.0(1mo ago)4118MITPHPPHP ^8.3

Since May 1Pushed 1mo agoCompare

[ Source](https://github.com/hamdyelbatal122/vaultic)[ Packagist](https://packagist.org/packages/hamzi/vaultic)[ RSS](/packages/hamzi-vaultic/feed)WikiDiscussions master Synced 1w ago

READMEChangelog (10)Dependencies (13)Versions (22)Used By (0)

Vaultic
=======

[](#vaultic)

Vaultic is a Laravel package for WebAuthn/Passkeys (FIDO2) with challenge storage, fallback authentication flows, multi-guard support, and web/API-ready response handling.

This v4.X release is optimized for Laravel 13 projects and modern PHP 8.3+ runtimes.

Compatibility
-------------

[](#compatibility)

- PHP `^8.3`
- Laravel `13.x`

Version Matrix
--------------

[](#version-matrix)

Vaultic TagPHPLaravelv1.0.27.1.3+5.5-5.8v1.2.17.2.5+6.xv1.3.07.2.5+7.xv3.0.18.0.2+9.xv3.1.08.1+10.xv3.2.18.2+11.xv3.3.18.2+12.xv4.0.08.3+13.xArchitecture
------------

[](#architecture)

Vaultic uses a layered architecture to keep framework glue and business logic separated:

- HTTP Layer: controllers + middleware
- Service Layer: WebAuthn orchestration and fallback decisions
- Repository Layer: passkey persistence abstraction
- Contracts Layer: interfaces for verifier, token issuing, service, and repository

Flow:

- Controller -> Service -> Repository -> Eloquent model

Highlights
----------

[](#highlights)

- Multi-guard authentication with per-guard model and identifier resolution
- Stateful web flows and stateless API flows from the same package endpoints
- UI-agnostic JSON endpoints that work with Blade, Livewire, Inertia, Vue, React, or native mobile clients
- Polymorphic passkey ownership, so passkeys can belong to different authenticatable models
- Optional token issuing abstraction for API guards, including a built-in Sanctum-friendly issuer
- Activity visibility in the management view, including last usage time and last IP used for a passkey

Installation
------------

[](#installation)

```
composer require hamzi/vaultic
```

Publish package assets:

```
php artisan vendor:publish --provider="Hamzi\\Vaultic\\VaulticServiceProvider" --tag=vaultic-config
php artisan vendor:publish --provider="Hamzi\\Vaultic\\VaulticServiceProvider" --tag=vaultic-migrations
php artisan vendor:publish --provider="Hamzi\\Vaultic\\VaulticServiceProvider" --tag=vaultic-views
php artisan migrate
```

Laravel package discovery is enabled by default. Manual registration remains available when needed:

Configuration
-------------

[](#configuration)

Vaultic ships with [config/vaultic.php](config/vaultic.php).

Vaultic no longer requires package-specific `.env` entries for the default setup.

By default, Vaultic derives the relying party from your main Laravel application settings (APP\_URL, APP\_NAME) and uses the default cache store configured in your app:

```
// config/vaultic.php
'cache' => [
    'store' => config('cache.default', 'file'), // Uses your app's default cache store
    'prefix' => 'vaultic:challenge:',
    'ttl' => 300,
],

'auth' => [
    'default_guard' => 'web',
    'guards' => [
        'web' => [
            'guard' => 'web',
            'provider_model' => App\Models\User::class,
            'identifier_column' => 'email',
        ],
        'api' => [
            'guard' => 'sanctum',
            'provider_model' => App\Models\User::class,
            'identifier_column' => 'email',
            'token_issuer' => Hamzi\Vaultic\Services\SanctumApiTokenIssuer::class,
        ],
    ],
],

'rate_limit' => [
    'attempts' => 10,
    'decay_seconds' => 60,
],

'resident_key' => 'required',
'authenticator_hints' => ['client-device', 'hybrid'],

'security' => [
    'store_last_used_ip' => true,
],

'fallback' => [
    'driver' => 'password',
],
```

If your app runs behind Cloudflare, Nginx, or a load balancer, configure Laravel trusted proxies correctly so passkey activity IP addresses are recorded accurately.

Guard configuration lives under `auth.guards` in [config/vaultic.php](config/vaultic.php). Each guard can define:

- `provider_model`
- `identifier_column`
- `stateful`
- `remember`
- `token_issuer`

For modern passkey UX, Vaultic enables discoverable credentials by default and can hint browsers toward:

- `client-device`: Face ID, Touch ID, Windows Hello, built-in biometrics
- `hybrid`: phone-assisted sign-in flows that typically rely on proximity transports such as Bluetooth

Browser and Device Coverage
---------------------------

[](#browser-and-device-coverage)

Vaultic follows the WebAuthn/FIDO2 standard and supports platform passkeys (Face ID, Touch ID, Windows Hello), hybrid phone flows, and roaming authenticators (USB/NFC/BLE security keys) when the client browser/device supports them.

In production, always test your own target matrix (OS + browser + authenticator type), because browser vendors may differ in UX details, transport handling, and conditional behavior.

Routes
------

[](#routes)

Vaultic exposes two channels by default:

- Web routes under `/passkeys` with name prefix `vaultic.`
- API routes under `/api/passkeys` with name prefix `vaultic.api.`
- `POST /passkeys/register/options` -> `vaultic.register.options`
- `POST /passkeys/register` -> `vaultic.register.store`
- `POST /passkeys/authenticate/options` -> `vaultic.authenticate.options`
- `POST /passkeys/authenticate` -> `vaultic.authenticate.store`
- `DELETE /passkeys/{passkey}` -> `vaultic.passkeys.destroy`
- `POST /api/passkeys/register/options` -> `vaultic.api.register.options`
- `POST /api/passkeys/register` -> `vaultic.api.register.store`
- `POST /api/passkeys/authenticate/options` -> `vaultic.api.authenticate.options`
- `POST /api/passkeys/authenticate` -> `vaultic.api.authenticate.store`

Rate limiting is applied using your Vaultic config values (`rate_limit.attempts`, `rate_limit.decay_seconds`) through Laravel throttle middleware.

All endpoints return JSON, so the package is not tied to any UI stack.

WebAuthn Verifier Contract
--------------------------

[](#webauthn-verifier-contract)

Vaultic does not force a specific FIDO2 vendor package. Bind your own verifier implementation:

```
$this->app->bind(
    Hamzi\Vaultic\Contracts\WebAuthnVerifier::class,
    App\Security\MyWebAuthnVerifier::class
);
```

If no verifier is bound, Vaultic throws a clear runtime exception instead of silently failing.

API Token Issuing
-----------------

[](#api-token-issuing)

For stateless guards, Vaultic can return token payloads after a successful passkey assertion.

Bind your own issuer:

```
$this->app->bind(
    Hamzi\Vaultic\Contracts\ApiTokenIssuer::class,
    App\Auth\IssueVaulticToken::class
);
```

Or use the included Sanctum-oriented issuer when your authenticatable model exposes `createToken()`:

```
'auth' => [
    'guards' => [
        'api' => [
            'guard' => 'sanctum',
            'provider_model' => App\Models\User::class,
            'identifier_column' => 'email',
            'stateful' => false,
            'token_issuer' => Hamzi\Vaultic\Services\SanctumApiTokenIssuer::class,
        ],
    ],
],
```

Successful API authentication responses include a `tokens` array in the JSON payload.

Blade Integration
-----------------

[](#blade-integration)

Vaultic now ships with publishable Tailwind-ready Blade primitives on top of the JSON endpoints, so you can use the package without building your own JavaScript WebAuthn bridge first.

### Passkey Login Button

[](#passkey-login-button)

The default button is compact, Tailwind-based, and intentionally small so you can place it inline in forms, toolbars, modals, or profile screens.

Minimal discoverable login button:

```

```

Full-width button inside a card or auth form:

```

```

Component usage:

```

```

Optional account-scoped login when you still want an identifier field:

```

```

Directive usage:

```
@passkeyButton(['size' => 'sm', 'fullWidth' => false])
```

Helper usage:

```
{{ vaultic_passkey_button(['size' => 'sm']) }}
```

### Passkey Management Panel

[](#passkey-management-panel)

Render the Tailwind registration form and linked-passkeys table anywhere inside your authenticated Blade views:

```

```

The management panel stays fully Tailwind-based and includes:

- compact registration CTA
- discoverable passkey copy
- linked authenticators table
- last used timestamp and last used IP activity visibility
- device deletion actions

Or through the directive/helper APIs:

```
@passkeyPanel()

{{ vaultic_passkey_panel() }}
```

Both primitives are customizable through props, route overrides, labels, sizes, width control, and by publishing the package views with `vaultic-views`.

Supported authenticator experiences depend on the browser and device, but Vaultic is configured to work well with:

- Face ID
- Touch ID
- Windows Hello
- Nearby phones in hybrid flows
- USB, NFC, and BLE security keys

Frontend Integration
--------------------

[](#frontend-integration)

If you prefer a custom client, Vaultic still exposes the raw JSON endpoints for:

- Blade pages with your own markup
- Inertia or SPA frontends
- Native mobile or hybrid clients through API routes
- Admin panels with separate guards and authenticatable models

Middleware
----------

[](#middleware)

Use `passkey.required` for routes that must have a passkey-authenticated session.

```
Route::middleware(['auth', 'passkey.required'])->group(function () {
    Route::get('/settings/security', function () {
        return 'ok';
    });
});
```

Events
------

[](#events)

- `Hamzi\Vaultic\Events\PasskeyRegistered`
- `Hamzi\Vaultic\Events\PasskeyAuthenticated`
- `Hamzi\Vaultic\Events\AuthenticationFailed`

Tests
-----

[](#tests)

```
composer test
```

Includes:

- unit tests for challenge issuance/pull behavior
- feature tests for route registration and middleware behavior
- service tests for multi-guard resolution, stateful login flow, and stateless token payloads

Repository Standards
--------------------

[](#repository-standards)

- License: [LICENSE](LICENSE)
- Contribution Guide: [CONTRIBUTING.md](CONTRIBUTING.md)
- Security Policy: [SECURITY.md](SECURITY.md)
- Code of Conduct: [CODE\_OF\_CONDUCT.md](CODE_OF_CONDUCT.md)
- Changelog: [CHANGELOG.md](CHANGELOG.md)

License
-------

[](#license)

vaultic is open-sourced software licensed under the MIT license. See [LICENSE](LICENSE) for more details.

###  Health Score

45

—

FairBetter than 91% of packages

Maintenance89

Actively maintained with recent releases

Popularity14

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity58

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~2 days

Recently: every ~8 days

Total

21

Last Release

54d ago

Major Versions

v1.3.0 → v2.0.02026-05-01

v2.0.0 → v3.0.02026-05-01

v3.3.0 → v4.0.02026-05-01

v1.2.1 → v3.0.12026-05-01

v3.3.1 → 4.0.12026-05-01

PHP version history (10 changes)v1.0.0PHP ^8.2

v1.0.1PHP ^7.1

v1.2.0PHP ^7.2

v1.3.0PHP ^7.2.5

v2.0.0PHP ^7.3

v3.0.0PHP ^8.0

v3.1.0PHP ^8.1

v4.0.0PHP ^8.3

v1.0.2PHP ^7.1.3

v3.0.1PHP ^8.0.2

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/36019461?v=4)[Hamdy Elbatal](/maintainers/hamdyelbatal122)[@hamdyelbatal122](https://github.com/hamdyelbatal122)

---

Top Contributors

[![hamdyelbatal122](https://avatars.githubusercontent.com/u/36019461?v=4)](https://github.com/hamdyelbatal122 "hamdyelbatal122 (73 commits)")

---

Tags

laravelAuthenticationFIDO2webauthnpasskeysvaultic

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/hamzi-vaultic/health.svg)

```
[![Health](https://phpackages.com/badges/hamzi-vaultic/health.svg)](https://phpackages.com/packages/hamzi-vaultic)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3345.3M347](/packages/psalm-plugin-laravel)[roots/acorn

Framework for Roots WordPress projects built with Laravel components.

9762.4M133](/packages/roots-acorn)[laravel/pulse

Laravel Pulse is a real-time application performance monitoring tool and dashboard for your Laravel application.

1.7k15.1M136](/packages/laravel-pulse)[aedart/athenaeum

Athenaeum is a mono repository; a collection of various PHP packages

255.2k](/packages/aedart-athenaeum)[flarum/core

Delightfully simple forum software.

211.4M2.4k](/packages/flarum-core)[laravel/mcp

Rapidly build MCP servers for your Laravel applications.

77922.3M186](/packages/laravel-mcp)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)