Laravel Fortify

https://github.com/laravel/fortify
Admin
Laravel Fortify is a frontend agnostic authentication backend for Laravel, powering registration,...
Tokens:77,392
Snippets:635
Trust Score:9.7
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Generated FortifyServiceProvider Stub

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/console-install-command.md

An example of the generated FortifyServiceProvider file created after running the installation command.

```php
// app/Providers/FortifyServiceProvider.php — generated stub
namespace App\Providers;

class FortifyServiceProvider extends ServiceProvider
{
    public function register(): void
    {
        //
    }

    public function boot(): void
    {
        Fortify::createUsersUsing(CreateNewUser::class);
        Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);
        Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
        Fortify::redirectUserForTwoFactorAuthenticationUsing(RedirectIfTwoFactorAuthenticatable::class);

        RateLimiter::for('login', function (Request $request) { /* ... */ });
        RateLimiter::for('two-factor', function (Request $request) { /* ... */ });
        RateLimiter::for('passkeys', function (Request $request) { /* ... */ });
    }
}
```

--------------------------------

### Usage example: enable 2FA with confirmation

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/features.md

Example of enabling two-factor authentication with confirmation options in the fortify config file.

```php
use Laravel\Fortify\Features;

// config/fortify.php — enable 2FA with confirmation
'features' => [
    Features::twoFactorAuthentication([
        'confirm' => true,
        'confirmPassword' => true,
    ]),
],
```

--------------------------------

### Running the Fortify Install Command

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/console-install-command.md

The CLI command used to install Fortify resources into a project, along with the expected success message.

```bash
cd /path/to/project
php artisan fortify:install

# Console output:
# "Fortify scaffolding installed successfully."
```

--------------------------------

### Usage example: option-gated middleware

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/features.md

Example of conditionally applying middleware based on the confirmPassword option of two-factor authentication.

```php
// Optionally gated middleware
$middleware = Features::optionEnabled(Features::twoFactorAuthentication(), 'confirmPassword')
    ? ['auth:web', 'password.confirm']
    : ['auth:web'];
```

--------------------------------

### Usage examples for RecoveryCode::generate()

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/recovery-code.md

Shows how to use the default generator and how to install a custom generator via Fortify::generateRecoveryCodesUsing(). The custom generator is invoked per code, not per batch.

```php
use Laravel\Fortify\RecoveryCode;

// Default generator — used by EnableTwoFactorAuthentication / GenerateNewRecoveryCodes
$code = RecoveryCode::generate();       // e.g. "4F2d9qXv1A-8pTkLm3zQw"

// Custom generator installed once at boot (e.g. hex codes)
Fortify::generateRecoveryCodesUsing(function () {
    return Str::random(16);             // opaque, no separator
});

$code = RecoveryCode::generate();       // now uses the custom generator
```

--------------------------------

### Usage example: route registration with enabled()

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/features.md

Example of conditionally registering a route when the reset-passwords feature is enabled.

```php
// Controllers / route registration
if (Features::enabled(Features::resetPasswords())) {
    Route::post('/forgot-password', [PasswordResetLinkController::class, 'store']);
}
```

--------------------------------

### Customizing route paths with RoutePath::for()

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/route-path.md

Shows how to customize route paths in config/fortify.php and how the package uses RoutePath::for() to register routes. The example maps 'login' to '/sign-in' and 'two-factor.qr-code' to '/user/2fa/qr', resulting in GET /sign-in for the login route.

```php
// config/fortify.php
'paths' => [
    'login' => '/sign-in',
    'two-factor' => [
        'qr-code' => '/user/2fa/qr',
    ],
],

// routes/routes.php (package internals — shown for reference)
Route::get(RoutePath::for('login', '/login'), [AuthenticatedSessionController::class, 'create']);
// → GET /sign-in
```

--------------------------------

### Usage examples for createUsersUsing, redirectUserForTwoFactorAuthenticationUsing, and generateRecoveryCodesUsing

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Shows three usage examples: registering a custom user-creation class, a custom two-factor redirect implementation, and a custom recovery code format using a closure that returns Str::random(24).

```php
// Custom user-creation class
Fortify::createUsersUsing(CreateNewUser::class);

// Custom two-factor redirect implementation
Fortify::redirectUserForTwoFactorAuthenticationUsing(MyTwoFactorRedirect::class);

// Custom recovery code format
Fortify::generateRecoveryCodesUsing(function () {
    return Str::random(24);
});
```

--------------------------------

### InstallCommand handle() Method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/console-install-command.md

The public handle method that executes the installation procedure, including publishing resources and registering the service provider.

```php
public function handle()
```

--------------------------------

### InstallCommand Class Metadata

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/console-install-command.md

Defines the command signature and description for the fortify:install console command.

```php
#[AsCommand(name: 'fortify:install')]
class InstallCommand extends Command
{
    protected $signature = 'fortify:install';

    protected $description = 'Install all of the Fortify resources';
}
```

--------------------------------

### Publish Fortify scaffolding

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify-service-provider.md

Publishes Fortify scaffolding. Run from the command line after the package is installed.

```bash
php artisan fortify:install
```

--------------------------------

### Boot method signature

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify-service-provider.md

Runs during provider boot. Configures publishing of stubs and migrations, registers routes from routes/routes.php when Fortify::$registersRoutes is true, and registers the fortify:install console command when running in the console.

```php
public function boot()
```

--------------------------------

### GET /user/passkeys/options

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Retrieves registration options for adding a new passkey.

```APIDOC
## GET /user/passkeys/options

### Description
Retrieves registration options for adding a new passkey.

### Method
GET

### Endpoint
/user/passkeys/options

### Response
#### Success Response (200)
- Returns the WebAuthn registration options.
```

--------------------------------

### GET /passkeys/login/options

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Retrieves authentication options for passkey login.

```APIDOC
## GET /passkeys/login/options

### Description
Retrieves authentication options for passkey login.

### Method
GET

### Endpoint
/passkeys/login/options

### Response
#### Success Response (200)
- Returns the WebAuthn authentication options.
```

--------------------------------

### GET /passkeys/confirm/options

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Retrieves authentication options for confirming a passkey.

```APIDOC
## GET /passkeys/confirm/options

### Description
Retrieves authentication options for confirming a passkey.

### Method
GET

### Endpoint
/passkeys/confirm/options

### Response
#### Success Response (200)
- Returns the WebAuthn authentication options.
```

--------------------------------

### GET /login

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/endpoints.md

Displays the login form. This endpoint is only registered when the 'fortify.views' configuration is truthy and is accessible to guest users.

```APIDOC
## [GET] /login

### Description
Displays the login form. This endpoint is only registered when the 'fortify.views' configuration is truthy and is accessible to guest users.

### Method
GET

### Endpoint
/login

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
None

### Response
#### Success Response (200)
- **HTML** - The login view.

#### Response Example
```html
<!-- HTML content of the login view -->
```
```

--------------------------------

### GET register

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Displays the registration view.

```APIDOC
## GET register

### Description
Displays the registration view.

### Method
GET

### Endpoint
register

### Response
#### Success Response (200)
- **RegisterViewResponse** - The response containing the registration view.

### Response Example
{
  "view": "auth.register"
}
```

--------------------------------

### Usage example for TwoFactorAuthenticatable

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/two-factor-authenticatable.md

Shows how to use the trait in a user model and demonstrates calling its methods. Includes rotating a recovery code after use.

```php
// app/Models/User.php
use Laravel\Fortify\TwoFactorAuthenticatable;
use Laravel\Fortify\PasskeyAuthenticatable;

class User extends Model
{
    use TwoFactorAuthenticatable, PasskeyAuthenticatable;

    // ...
}

// Usage
$user->hasEnabledTwoFactorAuthentication();          // bool
$user->twoFactorQrCodeSvg();                          // '<svg ...>...</svg>'
$codes = $user->recoveryCodes();                      // ['AAAAAAAAAA-BBBBBBBBBB', ...]

// After a recovery code was used, rotate it immediately
$user->replaceRecoveryCode($usedCode);
```

--------------------------------

### Using Fortify::redirects() with and without fallback

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Usage examples for Fortify::redirects(). The first call retrieves the login redirect from config with a fallback to the home route, and the second passes an explicit fallback for the logout redirect.

```php
// Basic
$loginRedirect = Fortify::redirects('login'); // config('fortify.redirects.login') ?? config('fortify.home')

// With explicit fallback
$logoutRedirect = Fortify::redirects('logout', '/');
```

--------------------------------

### Show registration form

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Returns the register view for the GET register route.

```php
public function create(Request $request): RegisterViewResponse
```

--------------------------------

### GET /register

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/endpoints.md

Displays the registration form view. Requires the registration feature to be enabled and the fortify.views configuration to be true. Authenticated users are redirected away.

```APIDOC
## [GET] /register

### Description
Displays the registration form view.

### Method
GET

### Endpoint
/register

### Parameters
#### Query Parameters
- None documented

### Request Example
No request body required.

### Response
#### Success Response (200)
- **HTML** - The registration form view.

#### Response Example
(HTML content not shown)
```

--------------------------------

### GET /user/two-factor-qr-code

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Retrieves the QR code for setting up two-factor authentication.

```APIDOC
## GET /user/two-factor-qr-code

### Description
Retrieves the QR code for setting up two-factor authentication.

### Method
GET

### Endpoint
/user/two-factor-qr-code

### Response
#### Success Response (200)
- Returns the QR code as an SVG or data URL.
```

--------------------------------

### NewPasswordController create method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Handles GET password.reset to display the password reset view.

```php
public function create(Request $request): ResetPasswordViewResponse
```

--------------------------------

### Laravel Fortify configuration example

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/configuration.md

Use this configuration to customize Laravel Fortify's authentication behavior, including enabling registration, password reset, profile updates, two-factor authentication, and passkeys. The 'features' array uses the Features class to enable each feature with optional settings like password confirmation.

```php
use Laravel\Fortify\Features;

return [
    'guard' => 'web',
    'passwords' => 'users',
    'username' => 'email',
    'email' => 'email',
    'lowercase_usernames' => true,
    'home' => '/home',
    'prefix' => '',
    'domain' => null,
    'middleware' => ['web'],
    'limiters' => [
        'login' => 'login',
        'two-factor' => 'two-factor',
        'passkeys' => 'passkeys',
    ],
    'views' => true,
    'paths' => [ 'login' => '/sign-in' ],
    'redirects' => [ 'login' => '/dashboard' ],
    'features' => [
        Features::registration(),
        Features::resetPasswords(),
        Features::updateProfileInformation(),
        Features::updatePasswords(),
        Features::twoFactorAuthentication([
            'confirm' => true,
            'confirmPassword' => true,
        ]),
        Features::passkeys([ 'confirmPassword' => true ]),
    ],
];
```

--------------------------------

### GET /user/confirm-password

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/endpoints.md

Displays the password confirmation form. Only available when views are enabled in Fortify configuration.

```APIDOC
## [GET] /user/confirm-password

### Description
Displays the password confirmation form. Only available when views are enabled in Fortify configuration.

### Method
GET

### Endpoint
/user/confirm-password

### Parameters
None

### Response
#### Success Response (200)
- **HTML** - Returns the password confirmation view

#### Response Example
(HTML view rendered)
```

--------------------------------

### GET two-factor.login

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Displays the two-factor authentication challenge view. Redirects to login if no challenged user exists.

```APIDOC
## GET two-factor.login

### Description
Displays the two-factor authentication challenge view for a user who has initiated a login but has not yet completed two-factor authentication.

### Method
GET

### Endpoint
two-factor.login

### Parameters
No parameters documented.

### Response
#### Success Response (200)
Returns a `TwoFactorChallengeViewResponse`.

#### Response Example
No response example provided.

### Errors
Redirects to the `login` route via `HttpResponseException` when `! $request->hasChallengedUser()`.
```

--------------------------------

### GET /reset-password/{token}

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/endpoints.md

Displays the password reset form for the given token. Returns an HTML view.

```APIDOC
## [GET] /reset-password/{token}

### Description
Displays the password reset form for the provided token.

### Method
GET

### Endpoint
/reset-password/{token}

### Parameters
#### Path Parameters
- **token** (string) - Required - The password reset token.

#### Query Parameters
None

#### Request Body
None

### Request Example
None

### Response
#### Success Response (200)
- **view** (HTML) - The password reset form view.

#### Response Example
```html
<!-- HTML view rendered -->
```
```

--------------------------------

### Registering Fortify views with viewPrefix and loginView

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Shows how to register views using viewPrefix with a namespace or loginView with a callable that returns an Inertia render.

```php
// Register a view name
Fortify::viewPrefix('auth::'); // registers 'auth::login', 'auth::two-factor-challenge', ...

// Or a callable per view
Fortify::loginView(function ($request) {
    return inertia()->render('auth/login');
});
```

--------------------------------

### Bootstrap Fortify with custom actions

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Typical bootstrap from stubs/FortifyServiceProvider.php, app-side provider boot().

```php
use Laravel\Fortify\Fortify;

Fortify::createUsersUsing(CreateNewUser::class);
Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);
Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
Fortify::redirectUserForTwoFactorAuthenticationUsing(RedirectIfTwoFactorAuthenticatable::class);
```

--------------------------------

### Example: overriding a response contract

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-responses.md

Example of overriding a response contract by binding a custom implementation in the service container.

```APIDOC
## Example: overriding a response contract

### Description
Shows how to override a response contract by binding a custom implementation in the service container.

### Code

```php
// app/Providers/AppServiceProvider.php
use Laravel\Fortify\Contracts\LoginResponse as LoginResponseContract;

class MyLoginResponse implements LoginResponseContract
{
    public function toResponse($request)
    {
        return $request->wantsJson()
            ? response()->json(['user' => $request->user()])
            : redirect()->intended('/dashboard');
    }
}

// boot():
app()->singleton(LoginResponseContract::class, MyLoginResponse::class);
```
```

--------------------------------

### Listening to Fortify events

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/events.md

Shows how to listen to Fortify events using the event() helper. Events are dispatched internally by Fortify; applications only listen.

```php
use Laravel\Fortify\Events\TwoFactorAuthenticationEnabled;
use Laravel\Fortify\Events\RecoveryCodeReplaced;

// Inside a listener class (auto-discovery by convention) or explicit wiring:
event(TwoFactorAuthenticationEnabled::class, function ($event) {
    Log::info("User {$event->user->getKey()} enabled two factor authentication.");
});

event(RecoveryCodeReplaced::class, function ($event) {
    notify($event->user, "Recovery code {$event->code} was used and rotated.");
});

// Events are dispatched by Fortify internally; applications only listen.
```

--------------------------------

### GET /user/two-factor-recovery-codes

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Retrieves the recovery codes for two-factor authentication.

```APIDOC
## GET /user/two-factor-recovery-codes

### Description
Retrieves the recovery codes for two-factor authentication.

### Method
GET

### Endpoint
/user/two-factor-recovery-codes

### Response
#### Success Response (200)
- Returns the recovery codes as a JSON array.
```

--------------------------------

### GET /email/verify

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Displays the email verification notice page.

```APIDOC
## GET /email/verify

### Description
Displays the email verification notice page.

### Method
GET

### Endpoint
/email/verify

### Response
#### Success Response (200)
- Returns the email verification notice view.
```

--------------------------------

### Configuration Mapping

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/passkey-authenticatable.md

FortifyServiceProvider::configurePasskeys() mirrors Fortify config into the passkeys.* config namespace.

```APIDOC
## Configuration handed to the passkeys package

`FortifyServiceProvider::configurePasskeys()` mirrors Fortify config into the `passkeys.*` config namespace:

| Fortify key | passkeys key | Default |
|-------------|--------------|---------|
| `fortify.passkeys.relying_party_id` | `passkeys.relying_party_id` | host of `app.url` |
| `fortify.passkeys.allowed_origins` | `passkeys.allowed_origins` | `[config('app.url')]` |
| `fortify.passkeys.user_handle_secret` | `passkeys.user_handle_secret` | `config('app.key')` (or env `PASSKEYS_USER_HANDLE_SECRET`) |
| `fortify.passkeys.timeout` | `passkeys.timeout` | `60000` |
| `fortify.guard` | `passkeys.guard` | `'web'` |
| `fortify.middleware` | `passkeys.middleware` | `['web']` |
| `fortify-options.passkeys.confirmPassword` | `passkeys.management_middleware` | `['password.confirm']` when true, else `[]` |
| — | `passkeys.redirect` | `Fortify::redirects('login')` |
| `fortify.limiters.passkeys` | `passkeys.throttle` | `'throttle:{limiter}'` or `null` |
```

--------------------------------

### InstallCommand registerFortifyServiceProvider() Method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/console-install-command.md

A protected method that registers the application's FortifyServiceProvider in the bootstrap file if supported by the framework.

```php
protected function registerFortifyServiceProvider(): void
```

--------------------------------

### twoFactorQrCodeSvg()

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/two-factor-authenticatable.md

Generates an SVG QR code for two-factor authentication setup.

```APIDOC
## twoFactorQrCodeSvg()

### Description
Renders the QR code for the two-factor authentication URL as an inline SVG string.

### Method
twoFactorQrCodeSvg

### Signature
public function twoFactorQrCodeSvg()

### Parameters
None

### Return
- **string** - SVG markup of the QR code.

### Source
`src/TwoFactorAuthenticatable.php:65`
```

--------------------------------

### GET /user/two-factor-secret-key

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/endpoints.md

Returns the user's two-factor authentication secret key.

```APIDOC
## [GET] /user/two-factor-secret-key

### Description
Returns the user's two-factor authentication secret key.

### Method
GET

### Endpoint
/user/two-factor-secret-key

### Route Name
two-factor.secret-key

### Controller
TwoFactorSecretKeyController@show

### Authentication
- {auth}:{guard}
- password.confirm (if confirmPassword option)

### Feature Gate
- feature enabled

### Responses
- Success: JSON {'secretKey': ...}
- No secret: 404 'Two factor authentication has not been enabled.'
```

--------------------------------

### viewPrefix method signature

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers conventional view names for all Fortify views. The prefix parameter is a string such as 'auth::'. Returns void.

```php
public static function viewPrefix(string $prefix)
```

--------------------------------

### GET password.reset

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Displays the password reset form for a user who has forgotten their password.

```APIDOC
## GET password.reset

### Description
Displays the password reset form for a user who has forgotten their password.

### Method
GET

### Endpoint
/password/reset

### Parameters
#### Query Parameters
- **token** (string) - Required - The password reset token sent to the user's email.
- **email** (string) - Required - The user's email address.

### Response
#### Success Response (200)
- **view** (ResetPasswordViewResponse) - The password reset form view.

#### Response Example
```html
<!-- HTML form for resetting password -->
```
```

--------------------------------

### LoginRateLimiter availableIn() Method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/login-rate-limiter.md

Method that returns the number of seconds until the throttle key is unlocked.

```php
public function availableIn(Request $request)
```

--------------------------------

### Register method signature

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify-service-provider.md

Runs during provider registration. Merges the package's config/fortify.php into the application under the 'fortify' config key, configures passkeys integration, binds response contracts, binds TwoFactorAuthenticationProvider as a singleton, binds RedirectsIfTwoFactorAuthenticatable as scoped, and binds StatefulGuard to the configured guard.

```php
public function register()
```

--------------------------------

### POST /user/confirmed-two-factor-authentication

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Confirms the two-factor authentication setup by providing a valid code.

```APIDOC
## POST /user/confirmed-two-factor-authentication

### Description
Confirms the two-factor authentication setup by providing a valid code.

### Method
POST

### Endpoint
/user/confirmed-two-factor-authentication

### Parameters
#### Request Body
- **code** (string) - Required - The two-factor authentication code.

### Response
#### Success Response (200)
- Redirects back with a success message.

#### Error Response (422)
- Returns validation errors.
```

--------------------------------

### Chain Fortify static configuration

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Chains encryptUsing and ignoreRoutes for static configuration.

```php
Fortify::encryptUsing(myEncrypter)->ignoreRoutes(); // chainable static configuration
```

--------------------------------

### Fortify configuration reader method signatures

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Method signatures for the Fortify configuration readers. username() returns the configured username field name, email() returns the email field name, and redirects() returns a redirect path based on the given config key with an optional fallback.

```php
public static function username()
```

```php
public static function email()
```

```php
public static function redirects(string $redirect, $default = null)
```

--------------------------------

### Fortify::authenticateThrough()

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers a callback that builds the authentication pipeline array.

```APIDOC
## Fortify::authenticateThrough()

### Description
Registers a callback that builds the authentication pipeline array. The callback should return an array of middleware/classes to be run during authentication.

### Method
Static method call

### Endpoint
`Fortify::authenticateThrough(callable $callback)`

### Parameters
- **$callback** (callable) - Required - The callback that returns the authentication pipeline array.

### Response
No return value (void).

### Example
```php
Fortify::authenticateThrough(function (Request $request) {
    return [
        // ...
    ];
});
```
```

--------------------------------

### PasswordResetLinkController create method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Handles GET password.request to display the password reset link request view.

```php
public function create(Request $request): RequestPasswordResetLinkViewResponse
```

--------------------------------

### viewPrefix(string $prefix)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers conventional view names for all Fortify views under a given prefix.

```APIDOC
## viewPrefix(string $prefix)

### Description
Registers conventional view names for all Fortify views under a given prefix.

### Method
viewPrefix

### Endpoint
`Fortify::viewPrefix(string $prefix)`

### Parameters
#### Path Parameters
- **prefix** (string) - Required - The prefix, e.g. `'auth::'`.

### Response
#### Success Response (void)
No return value.

### Source
`src/Fortify.php:121`
```

--------------------------------

### Get the current encrypter

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Returns the current encrypter: static::$encrypter, else Model::$encrypter, else Crypt::getFacadeRoot().

```php
public static function currentEncrypter()
```

--------------------------------

### viewNamespace(string $namespace)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers all seven conventional views under a namespace by delegating to viewPrefix($namespace.'::').

```APIDOC
## viewNamespace(string $namespace)

### Description
Registers all seven conventional views under a namespace by delegating to `viewPrefix($namespace.'::')`.

### Method
viewNamespace

### Endpoint
`Fortify::viewNamespace(string $namespace)`

### Parameters
#### Path Parameters
- **namespace** (string) - Required - The namespace (e.g. `'auth'`).

### Response
#### Success Response (void)
No return value.

### Source
`src/Fortify.php:110`
```

--------------------------------

### viewNamespace method signature

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers all seven conventional views under a namespace by delegating to viewPrefix($namespace.'::'). The namespace parameter is a string such as 'auth'. Returns void.

```php
public static function viewNamespace(string $namespace)
```

--------------------------------

### GET password.request

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Displays the password reset link request form where users can enter their email address to receive a reset link.

```APIDOC
## GET password.request

### Description
Displays the password reset link request form where users can enter their email address to receive a reset link.

### Method
GET

### Endpoint
/password/request

### Response
#### Success Response (200)
- **view** (RequestPasswordResetLinkViewResponse) - The password reset link request form view.

#### Response Example
```html
<!-- HTML form for requesting password reset link -->
```
```

--------------------------------

### Fortify::redirects(string $redirect, $default = null)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Returns a redirect path based on the Fortify configuration, with an optional fallback.

```APIDOC
## Fortify::redirects(string $redirect, $default = null)

### Description
Returns a redirect path based on the Fortify configuration, with an optional fallback.

### Method
GET

### Endpoint
Fortify::redirects(string $redirect, $default = null)

### Parameters
#### Path Parameters
- **redirect** (string) - Required - Config key suffix, e.g. 'login', 'register'.
- **default** (mixed) - Optional - Fallback when no config value exists.

### Response
#### Success Response (200)
- **return** (string) - The redirect path.

#### Response Example
```php
$loginRedirect = Fortify::redirects('login'); // config('fortify.redirects.login') ?? config('fortify.home')
$logoutRedirect = Fortify::redirects('logout', '/');
```
```

--------------------------------

### Fortify::redirects($key, $default = null)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Reads a configured redirect target from the fortify config, with an optional default value.

```APIDOC
## [GET] /fortify/redirects/{key}

### Description
Retrieves a redirect path from the fortify configuration.

### Method
GET

### Endpoint
/fortify/redirects/{key}

### Parameters
#### Path Parameters
- **key** (string) - Required - The configuration key to look up

#### Query Parameters
- **default** (string) - Optional - Default value if key is not found

### Response
#### Success Response (200)
- **redirect** (string) - The configured redirect path or default

#### Response Example
{
  "redirect": "/home"
}
```

--------------------------------

### GET password.confirmation

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Returns the password confirmation status for the current user. The response indicates whether the password was confirmed within the configured timeout window.

```APIDOC
## GET password.confirmation

### Description
Returns the password confirmation status for the current user. The response indicates whether the password was confirmed within the configured timeout window.

### Method
GET

### Endpoint
password.confirmation

### Response
#### Success Response (200)
- **confirmed** (boolean) - Whether the password is currently confirmed.

#### Response Example
{
  "confirmed": true
}

### Headers
- **X-Retry-After** (string) - When confirmed, the number of seconds since the last confirmation.
```

--------------------------------

### Index recovery codes

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Returns a decrypted JSON array of recovery codes for the GET two-factor.recovery-codes route. Returns an empty array when no secret or codes are stored.

```php
public function index(Request $request)
```

--------------------------------

### View registration methods for individual views

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Each method registers a singleton binding for the matching view-response contract, wrapping $view in a SimpleViewResponse. The view parameter can be a view name string or a callable receiving the request. Returns void.

```php
public static function loginView($view)
```

```php
public static function twoFactorChallengeView($view)
```

```php
public static function resetPasswordView($view)
```

```php
public static function registerView($view)
```

```php
public static function verifyEmailView($view)
```

```php
public static function confirmPasswordView($view)
```

```php
public static function requestPasswordResetLinkView($view)
```

--------------------------------

### Using PasskeyAuthenticatable in a User model

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/passkey-authenticatable.md

Example of including the PasskeyAuthenticatable trait in a Laravel model. Once the 'passkeys' feature is enabled in config/fortify.php, the passkey management routes (/user/passkeys/**) become available.

```php
// app/Models/User.php
use Laravel\Fortify\PasskeyAuthenticatable;

class User extends Model
{
    use PasskeyAuthenticatable;

    // Passkey management routes (/user/passkeys/**) become available once the
    // 'passkeys' feature is enabled in config/fortify.php.
}
```

--------------------------------

### Laravel\Fortify\RoutePath::for

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/route-path.md

Documentation for the static method `for` of the `Laravel\Fortify\RoutePath` class, including parameters, return type, and recognized route-name keys.

```APIDOC
## `Laravel\Fortify\RoutePath::for(string $routeName, string $default)`

### Description
Resolves a route path from the `fortify.paths` configuration map, falling back to a default path if no entry exists. This static method is used internally by Fortify to register routes with customizable paths.

### Method
`for` (static method)

### Signature
```php
public static function for(string $routeName, string $default)
```

### Parameters
- **routeName** (string) - Required - Dot-notation key into `fortify.paths`, e.g. `'login'`, `'password.request'`, `'two-factor.qr-code'`.
- **default** (string) - Required - The path used when no `fortify.paths.{routeName}` entry exists.

### Return
- **string** - `config('fortify.paths.'.$routeName) ?? $default`

### Example
```php
// config/fortify.php
'paths' => [
    'login' => '/sign-in',
    'two-factor' => [
        'qr-code' => '/user/2fa/qr',
    ],
],

// routes/routes.php (package internals — shown for reference)
Route::get(RoutePath::for('login', '/login'), [AuthenticatedSessionController::class, 'create']);
// → GET /sign-in
```

### Recognized route-name keys
| Key | Default path |
|-----|--------------|
| `login` | `/login` |
| `logout` | `/logout` |
| `password.request` | `/forgot-password` |
| `password.reset` | `/reset-password/{token}` |
| `password.email` | `/forgot-password` |
| `password.update` | `/reset-password` |
| `password.confirm` | `/user/confirm-password` |
| `password.confirmation` | `/user/confirmed-password-status` |
| `register` | `/register` |
| `verification.notice` | `/email/verify` |
| `verification.verify` | `/email/verify/{id}/{hash}` |
| `verification.send` | `/email/verification-notification` |
| `user-profile-information.update` | `/user/profile-information` |
| `user-password.update` | `/user/password` |
| `two-factor.login` | `/two-factor-challenge` |
| `two-factor.enable` | `/user/two-factor-authentication` |
| `two-factor.confirm` | `/user/confirmed-two-factor-authentication` |
| `two-factor.disable` | `/user/two-factor-authentication` |
| `two-factor.qr-code` | `/user/two-factor-qr-code` |
| `two-factor.secret-key` | `/user/two-factor-secret-key` |
| `two-factor.recovery-codes` | `/user/two-factor-recovery-codes` |
| `passkey.login-options` | `/passkeys/login/options` |
| `passkey.login` | `/passkeys/login` |
| `passkey.confirm-options` | `/passkeys/confirm/options` |
| `passkey.confirm` | `/passkeys/confirm` |
| `passkey.registration-options` | `/user/passkeys/options` |
| `passkey.store` | `/user/passkeys` |
| `passkey.destroy` | `/user/passkeys/{passkey}` |
```

--------------------------------

### BaseFormRequest using InteractsWithTwoFactorState

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/interacts-with-two-factor-state.md

Example of a FormRequest base class that uses the InteractsWithTwoFactorState trait and calls ensureStateIsValid() in its validate() method. The mixin assumes $this->user(), $this->session(), and $this->hasOldInput() exist.

```php
// FormRequest base class (application glue — the mixin assumes $this->user(),
// $this->session(), and $this->hasOldInput() exist)
use Laravel\Fortify\InteractsWithTwoFactorState;

class BaseFormRequest extends FormRequest
{
    use InteractsWithTwoFactorState;

    public function validate(): array
    {
        $this->ensureStateIsValid();
        return parent::validate();
    }
}
```

--------------------------------

### POST /register

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Registers a new user account.

```APIDOC
## POST /register

### Description
Registers a new user account.

### Method
POST

### Endpoint
/register

### Parameters
#### Request Body
- **name** (string) - Required - The user's full name.
- **email** (string) - Required - The user's email address.
- **password** (string) - Required - The user's password.
- **password_confirmation** (string) - Required - Confirmation of the password.

### Response
#### Success Response (200)
- Redirects to the home page or intended destination.

#### Error Response (422)
- Returns validation errors.
```

--------------------------------

### Enable Two Factor Rate Limiting in Fortify

Source: https://github.com/laravel/fortify/blob/1.x/UPGRADE.md

To enable the two factor brute force security fix, configure the 'two-factor' limiter in the fortify.php configuration file and then define the rate limiter in the boot method of FortifyServiceProvider. The limiter allows 5 attempts per minute per login session.

```php
'limiters' => [
    'login' => 'login',
    'two-factor' => 'two-factor',
],
```

```php
RateLimiter::for('two-factor', function (Request $request) {
    return Limit::perMinute(5)->by($request->session()->get('login.id'));
});
```

--------------------------------

### loginView($view)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers a singleton binding for the LoginViewResponse contract wrapping the given view.

```APIDOC
## loginView($view)

### Description
Registers a singleton binding for the LoginViewResponse contract wrapping the given view.

### Method
loginView

### Endpoint
`Fortify::loginView($view)`

### Parameters
#### Path Parameters
- **view** (callable|string) - Required - View name (string) or a callable receiving the request.

### Response
#### Success Response (void)
No return value.

### Source
`src/Fortify.php:138`
```

--------------------------------

### Using Laravel\Fortify\Rules\Password with fluent setters

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/rules-password.md

Example usage of the deprecated Laravel\Fortify\Rules\Password rule. It sets a minimum length of 12, requires uppercase, numeric, and special characters, and overrides the failure message. Prefer Illuminate\Validation\Rules\Password in new code.

```php
// Note: prefer Illuminate\Validation\Rules\Password in new code.
use Laravel\Fortify\Rules\Password as LegacyPasswordRule;

Validator::make($input, [
    'password' => ['required', new LegacyPasswordRule()
        ->length(12)
        ->requireUppercase()
        ->requireNumeric()
        ->requireSpecialCharacter()
        ->withMessage('Choose a stronger password.')],
])->validate();
```

--------------------------------

### Fortify::authenticateUsing()

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers a callback that validates authentication credentials.

```APIDOC
## Fortify::authenticateUsing()

### Description
Registers a callback that validates authentication credentials. The callback should return the authenticated user or null.

### Method
Static method call

### Endpoint
`Fortify::authenticateUsing(callable $callback)`

### Parameters
- **$callback** (callable) - Required - The callback that validates credentials.

### Response
No return value (void).

### Example
```php
Fortify::authenticateUsing(function (Request $request) {
    // ...
    return $user;
});
```
```

--------------------------------

### neverFinishedConfirmingTwoFactorAuthentication(int $currentTime) method signature

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/interacts-with-two-factor-state.md

Method signature that returns true when there is no old 'code' input, two_factor_confirmed_at is null, and the session's two_factor_confirming_at does not equal the current time, indicating confirmation was started but never completed.

```php
protected function neverFinishedConfirmingTwoFactorAuthentication(int $currentTime)
```

--------------------------------

### Register new user

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Handles the POST register route. Lowercases the username when configured, dispatches Illuminate\Auth\Events\Registered with the created user, logs the user in via $this->guard->login($user, $request->boolean('remember')), regenerates the session, and returns a RegisterResponse.

```php
public function store(Request $request, CreatesNewUsers $creator): RegisterResponse
```

--------------------------------

### GET /email/verify/{id}/{hash}

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/endpoints.md

Verifies the user's email address using the provided ID and hash. The hash must match the SHA1 of the user's email. Returns a JSON 204 response or an HTML redirect with a verified parameter.

```APIDOC
## [GET] /email/verify/{id}/{hash}

### Description
Verifies the user's email address.

### Method
GET

### Endpoint
/email/verify/{id}/{hash}

### Parameters
#### Path Parameters
- **id** (integer) - Required - The user's ID.
- **hash** (string) - Required - The SHA1 hash of the user's email address.

### Request Example
No request body required.

### Response
#### Success Response (204)
- **JSON** - Empty body.

#### Response Example
(No content)
```

--------------------------------

### Overriding LoginResponse contract

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-responses.md

Example of overriding a response contract in Laravel Fortify. Define a custom class implementing LoginResponseContract and bind it in the service container using app()->singleton. The toResponse method returns a JSON response for API requests or redirects to /dashboard otherwise.

```php
// app/Providers/AppServiceProvider.php
use Laravel\Fortify\Contracts\LoginResponse as LoginResponseContract;

class MyLoginResponse implements LoginResponseContract
{
    public function toResponse($request)
    {
        return $request->wantsJson()
            ? response()->json(['user' => $request->user()])
            : redirect()->intended('/dashboard');
    }
}

// boot():
app()->singleton(LoginResponseContract::class, MyLoginResponse::class);
```

--------------------------------

### NewPasswordController store method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Handles POST password.update to reset the user's password. Lowercases email when configured, validates token and email, and uses the password broker to reset. Returns PasswordResetResponse on success, otherwise FailedPasswordResetResponse.

```php
public function store(Request $request): Responsable
```

--------------------------------

### PrepareAuthenticatedSession constructor and handle signatures

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/actions.md

Constructor and handle method signatures for the PrepareAuthenticatedSession action. Regenerates the session ID (when a session exists) and clears login throttle state, then continues.

```php
public function __construct(LoginRateLimiter $limiter)
```

```php
public function handle($request, $next)
```

--------------------------------

### Fortify::confirmPasswordsUsing()

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers a callback that confirms user passwords.

```APIDOC
## Fortify::confirmPasswordsUsing()

### Description
Registers a callback that confirms user passwords. The callback should return a boolean indicating if the password is valid.

### Method
Static method call

### Endpoint
`Fortify::confirmPasswordsUsing(callable $callback)`

### Parameters
- **$callback** (callable) - Required - The callback that confirms the password.

### Response
No return value (void).

### Example
```php
Fortify::confirmPasswordsUsing(function (Request $request, string $password) {
    // ...
    return true;
});
```
```

--------------------------------

### Response constructor with status string

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-responses.md

Constructor signature for response classes that accept a broker status string, used as a translation key via trans($status).

```php
public function __construct(string $status)
```

--------------------------------

### POST /login

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Authenticates a user with the provided credentials.

```APIDOC
## POST /login

### Description
Authenticates a user with the provided credentials.

### Method
POST

### Endpoint
/login

### Parameters
#### Request Body
- **email** (string) - Required - The user's email address.
- **password** (string) - Required - The user's password.

### Response
#### Success Response (200)
- Redirects to the intended destination or home page.

#### Error Response (422)
- Returns validation errors for invalid credentials.
```

--------------------------------

### LoginRateLimiter attempts() Method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/login-rate-limiter.md

Method that returns the number of attempts for the current throttle key.

```php
public function attempts(Request $request)
```

--------------------------------

### POST /passkeys/login

Source: https://github.com/laravel/fortify/blob/1.x/resources/boost/skills/fortify-development/SKILL.md

Authenticates a user using a passkey.

```APIDOC
## POST /passkeys/login

### Description
Authenticates a user using a passkey.

### Method
POST

### Endpoint
/passkeys/login

### Parameters
#### Request Body
- **id** (string) - Required - The passkey credential ID.
- **rawId** (string) - Required - The raw credential ID.
- **response** (object) - Required - The WebAuthn response.
- **type** (string) - Required - The credential type.

### Response
#### Success Response (200)
- Redirects to the intended destination.

#### Error Response (422)
- Returns validation errors.
```

--------------------------------

### AuthenticatedSessionController create method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Renders the login view using the LoginViewResponse class.

```php
public function create(Request $request): LoginViewResponse
```

--------------------------------

### Custom two-factor redirector replacement

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/actions.md

Shows how to replace the built-in challenge redirector from application code using Fortify::redirectUserForTwoFactorAuthenticationUsing. The custom class must implement the RedirectsIfTwoFactorAuthenticatable contract.

```php
// Replacing the built-in challenge redirector from application code:
Fortify::redirectUserForTwoFactorAuthenticationUsing(CustomTwoFactorRedirect::class);

// CustomTwoFactorRedirect must implement
// Laravel\Fortify\Contracts\RedirectsIfTwoFactorAuthenticatable::handle($request, $next)
```

--------------------------------

### verifyEmailView($view)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers a singleton binding for the VerifyEmailViewResponse contract wrapping the given view.

```APIDOC
## verifyEmailView($view)

### Description
Registers a singleton binding for the VerifyEmailViewResponse contract wrapping the given view.

### Method
verifyEmailView

### Endpoint
`Fortify::verifyEmailView($view)`

### Parameters
#### Path Parameters
- **view** (callable|string) - Required - View name (string) or a callable receiving the request.

### Response
#### Success Response (void)
No return value.

### Source
`src/Fortify.php:190`
```

--------------------------------

### confirmPasswordView($view)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers a singleton binding for the ConfirmPasswordViewResponse contract wrapping the given view.

```APIDOC
## confirmPasswordView($view)

### Description
Registers a singleton binding for the ConfirmPasswordViewResponse contract wrapping the given view.

### Method
confirmPasswordView

### Endpoint
`Fortify::confirmPasswordView($view)`

### Parameters
#### Path Parameters
- **view** (callable|string) - Required - View name (string) or a callable receiving the request.

### Response
#### Success Response (void)
No return value.

### Source
`src/Fortify.php:203`
```

--------------------------------

### updateUserProfileInformationUsing($callback)

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers the callback as the app singleton for \Laravel\Fortify\Contracts\UpdatesUserProfileInformation.

```APIDOC
## updateUserProfileInformationUsing($callback)

### Description
Registers the callback as the app singleton for `\Laravel\Fortify\Contracts\UpdatesUserProfileInformation`.

### Method
`public static function updateUserProfileInformationUsing($callback)`

### Parameters
- **callback** (callable|string) - Required - The callback or class name to register.

### Return
`void`

### Source
`src/Fortify.php:295`
```

--------------------------------

### updateUserProfileInformationUsing() singleton registration

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/fortify.md

Registers the callback as the app singleton for \Laravel\Fortify\Contracts\UpdatesUserProfileInformation.

```php
public static function updateUserProfileInformationUsing($callback)
```

--------------------------------

### ConfirmablePasswordController show method

Source: https://github.com/laravel/fortify/blob/1.x/_autodocs/api-reference/http-controllers.md

Returns the ConfirmPasswordViewResponse for the password confirmation route.

```php
public function show(Request $request)
```
Tokens:
Raw