PHPackages                             jarir-ahmed/auth-microservice - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. jarir-ahmed/auth-microservice

ActiveLibrary[Authentication & Authorization](/categories/authentication)

jarir-ahmed/auth-microservice
=============================

Standalone auth microservice package — Registration, Login, 2FA, Password Reset & more.

011↓83.3%1PHP

Since Jul 4Pushed 1mo agoCompare

[ Source](https://github.com/jarir2020/jarir-ahmed-auth-microservice)[ Packagist](https://packagist.org/packages/jarir-ahmed/auth-microservice)[ RSS](/packages/jarir-ahmed-auth-microservice/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependenciesVersions (1)Used By (1)

jarir-ahmed/auth-microservice
=============================

[](#jarir-ahmedauth-microservice)

A self-contained PHP auth package for Laravel. Ships with its own routes, controllers, migrations, config, and views — zero external runtime dependencies.

Features
--------

[](#features)

ModuleDescriptionRegistrationEmail/password registration, email verification, resend verificationLoginEmail/password login, remember me, session management, last online trackingMagic LinkPasswordless one-click sign-in via emailSocial LoginGoogle, Facebook, GitHub, Twitter, LinkedIn — native OAuth 2.0Two-Factor AuthNative TOTP (RFC 6238), backup codes, `otpauth://` URI for QR renderingPassword ResetToken-based reset flow, expiry handlingAPI Tokens64-char random hex tokens, SHA-256 hashed, scoped, revocableAccount LockoutLock after N failed attempts, configurable timeout, admin unlockProfileUpdate profile, change password, close accountTracking & AuditIP, geolocation, device, OS, browser on every auth eventSecurity NotificationsEmail alerts for new-device login, password change, 2FA toggleData Export / GDPRExport user data as JSON/CSV, account deletion flowAdmin ToolsUser listing, ban/unban, impersonation, admin unlockRequirements
------------

[](#requirements)

- PHP >= 8.0
- Extensions: `ext-hash`, `ext-json`, `ext-curl`, `ext-mbstring`, `ext-sodium`
- (Optional) Laravel >= 11.0 if using as a Laravel drop-in

Installation
------------

[](#installation)

```
composer require jarir-ahmed/auth-microservice
```

### For Non-Laravel (Framework-Agnostic) Users

[](#for-non-laravel-framework-agnostic-users)

Since this package is completely framework-agnostic, you can integrate it into any PHP application (Symfony, Slim, vanilla PHP):

1. **Dependency Injection**: Use our provided `Container` (or your own PSR-11 container) to bind the required Repositories.

```
use JarirAhmed\AuthMicroservice\Container;
use JarirAhmed\AuthMicroservice\Contracts\UserRepositoryInterface;
use App\Repositories\MyUserRepository;

$container = new Container();
$container->bind(UserRepositoryInterface::class, function () {
    return new MyUserRepository(); // Provide your own DB implementation
});
```

2. **Configuration**: Load the package configuration array and customize it for your needs.
3. **Database**: Use the provided schemas in `database/migrations` to create the required tables in your database using your preferred tool (Phinx, Doctrine, raw SQL).

### For Laravel Users (Drop-in)

[](#for-laravel-users-drop-in)

If you are using Laravel, the package will auto-discover its Service Provider and act as a seamless drop-in.

Publish config and migrations:

```
php artisan vendor:publish --tag=auth-microservice-config
php artisan vendor:publish --tag=auth-microservice-migrations
php artisan migrate
```

Configuration:

```
php artisan vendor:publish --tag=auth-microservice-config
```

Key settings in `config/auth-microservice.php`:

```
'user_model' => \App\Models\User::class,

'registration' => [
    'require_email_verification' => true,
],

'lockout' => [
    'max_attempts'    => 5,
    'lockout_minutes' => 15,
],

'two_factor' => [
    'issuer' => env('APP_NAME', 'AuthMicroservice'),
],

'oauth' => [
    'google' => [
        'client_id'     => env('GOOGLE_CLIENT_ID'),
        'client_secret' => env('GOOGLE_CLIENT_SECRET'),
        'redirect_uri'  => env('GOOGLE_REDIRECT_URI'),
    ],
    // facebook, github, twitter, linkedin ...
],
```

Routes
------

[](#routes)

All routes are prefixed with `/auth` by default (configurable).

MethodURIDescriptionPOST`/auth/register`RegisterGET`/auth/email/verify`Verify emailPOST`/auth/email/resend`Resend verificationPOST`/auth/login`LoginPOST`/auth/logout`LogoutPOST`/auth/magic-link/send`Send magic linkGET`/auth/magic-link/verify`Verify magic linkGET`/auth/social/{provider}/redirect`OAuth redirectGET`/auth/social/{provider}/callback`OAuth callbackPOST`/auth/password/forgot`Send reset linkPOST`/auth/password/reset`Reset passwordPOST`/auth/2fa/enable`Enable 2FAPOST`/auth/2fa/disable`Disable 2FAPOST`/auth/2fa/verify`Verify 2FA codeGET`/auth/profile`Get profilePATCH`/auth/profile`Update profilePOST`/auth/profile/password`Change passwordDELETE`/auth/profile`Close accountGET`/auth/tokens`List tokensPOST`/auth/tokens`Create tokenDELETE`/auth/tokens/{id}`Revoke tokenGET`/auth/audit/login-history`Login historyGET`/auth/audit/logs`Audit logsPOST`/auth/export`Request data exportGET`/auth/export/{id}`Export statusGET`/auth/admin/users`List usersPOST`/auth/admin/users/{id}/ban`Ban userPOST`/auth/admin/users/{id}/unban`Unban userPOST`/auth/admin/users/{id}/unlock`Unlock accountPOST`/auth/admin/users/{id}/impersonate`Impersonate userPOST`/auth/impersonate/stop`Stop impersonatingMiddleware
----------

[](#middleware)

Register in your `bootstrap/app.php` or `Http/Kernel.php`:

```
use JarirAhmed\AuthMicroservice\Middleware\TokenAuthMiddleware;
use JarirAhmed\AuthMicroservice\Middleware\TwoFactorMiddleware;
use JarirAhmed\AuthMicroservice\Middleware\EmailVerifiedMiddleware;
use JarirAhmed\AuthMicroservice\Middleware\AccountLockoutMiddleware;
use JarirAhmed\AuthMicroservice\Middleware\LastOnlineMiddleware;
use JarirAhmed\AuthMicroservice\Middleware\TrackAuthMiddleware;
```

Design Decisions
----------------

[](#design-decisions)

- **Zero external runtime dependencies** — TOTP, OAuth 2.0, backup codes all implemented natively using PHP 8.0+ built-in extensions only
- **SHA-256 token storage** — plaintext token returned once on creation, only the hash stored in DB (same pattern as GitHub, GitLab, Laravel Sanctum)
- **Native TOTP** — RFC 6238 compliant, HMAC-SHA1 + time-step truncation, base32 encoded secrets
- **QR codes deferred to frontend** — package returns the `otpauth://` URI; client-side JS renders it
- **Event-driven** — every auth action fires an event; listeners handle logging, notifications, and tracking decoupled from the main flow
- **Extendable User model** — set `auth-microservice.user_model` to your own model

Testing
-------

[](#testing)

```
composer install
./vendor/bin/phpunit
```

License
-------

[](#license)

MIT

###  Health Score

21

—

LowBetter than 17% of packages

Maintenance60

Regular maintenance activity

Popularity6

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity11

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://www.gravatar.com/avatar/20700f34ff813055154e843bbdbe04d33320c1e6a81bbb3301cad67cb8350fd3?d=identicon)[jarircse16](/maintainers/jarircse16)

---

Top Contributors

[![jarir2020](https://avatars.githubusercontent.com/u/175597633?v=4)](https://github.com/jarir2020 "jarir2020 (7 commits)")

### Embed Badge

![Health badge](/badges/jarir-ahmed-auth-microservice/health.svg)

```
[![Health](https://phpackages.com/badges/jarir-ahmed-auth-microservice/health.svg)](https://phpackages.com/packages/jarir-ahmed-auth-microservice)
```

###  Alternatives

[tg/tgwebvalid

An easy way to validate Telegram Login Widget and Telegram Mini App users on your website using PHP

6827.5k1](/packages/tg-tgwebvalid)[vitalybaev/laravel5-dkim

Laravel 5/6 package for signing outgoing messages with DKIM.

3163.1k](/packages/vitalybaev-laravel5-dkim)[denniseilander/laravel-passport-scopes-restriction

Restrict scopes for different Laravel Passport clients.

1636.3k](/packages/denniseilander-laravel-passport-scopes-restriction)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)