Laravel Fortify

Laravel Fortify is a frontend-agnostic authentication backend for Laravel applications. It implements all of the authentication features found in Laravel’s Breeze and Jetstream starter kits — including login, registration, password reset, email verification, and two-factor authentication — without dictating any particular frontend implementation.

Instead of shipping views or a UI, Fortify registers the routes and controllers needed to fulfill authentication requirements, leaving all rendering to the developer. This makes it a natural fit for teams building custom frontends (Inertia, Livewire, an SPA, or a mobile API) who still want Laravel’s battle-tested authentication logic under the hood, including passkey support via laravel/passkeys and TOTP-based 2FA via pragmarx/google2fa.

What You Get

• Registration, login, and logout controllers with configurable route paths and middleware
• Password reset and email verification flows out of the box
• Two-factor authentication (TOTP) with recovery codes via pragmarx/google2fa
• WebAuthn/passkey authentication support through laravel/passkeys
• Rate limiting for login attempts via a configurable LoginRateLimiter
• Swappable actions for every step (e.g. CreateNewUser, ResetUserPassword) so behavior can be overridden without touching Fortify’s internals

Common Use Cases

• Building a custom-designed login/registration UI on top of Laravel’s official auth logic
• Adding two-factor authentication to an existing Laravel app without hand-rolling TOTP handling
• Powering the authentication backend for an Inertia.js or Livewire single-page application
• Providing a JSON-friendly authentication API for a separate SPA or mobile client

Under The Hood

Architecture - Fortify is structured as a Laravel package registered via FortifyServiceProvider, which binds a single routes/routes.php file defining all auth endpoints (login, register, password reset, verification, 2FA challenge) behind the app’s own middleware stack. Each endpoint delegates to a small, single-purpose Actions/* class (e.g. CreateNewUser, ResetUserPassword, ConfirmTwoFactorAuthentication) resolved out of the container, so the package ships behavior rather than views and leaves rendering entirely to the host app’s Fortify::loginView()/registerView() callbacks. Tech Stack - Pure PHP 8.2+ targeting Laravel 11/12/13 (illuminate/support, illuminate/console), with pragmarx/google2fa providing TOTP generation/verification, bacon/bacon-qr-code for 2FA QR codes, and laravel/passkeys for WebAuthn. Test tooling is orchestra/testbench plus phpstan for static analysis, orchestrated by testbench.yaml/workbench/ for isolated package testing. Code Quality - The tests/ directory holds 20 PHP test files covering registration, login, password reset, email verification, rate limiting, and 2FA flows; phpstan.neon.dist enforces static analysis in CI. Naming is consistent (Actions/, Http/Controllers/, Http/Requests/), and nearly every extension point is an interface bound in the service provider, making custom overrides a one-line Fortify::createUsersUsing() call rather than a subclass. API Design - Configuration lives in a single config/fortify.php with nullable path overrides and boolean feature toggles (Features::twoFactorAuthentication(), Features::registration()), giving a low-boilerplate way to enable exactly the auth surface an app needs; the trade-off is that meaningful use requires reading Laravel’s Fortify docs since the package intentionally exposes no UI to infer behavior from.