Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →For a custom Laravel frontend, Fortify supplies headless authentication flows; guards and providers determine which identity is authenticated and where it is loaded from. For a first-party SPA, Laravel documents using Fortify with the web guard and Sanctum—not adding JWT by default. Choose session cookies, API tokens, OAuth2, or a justified custom JWT design according to your clients and protocol requirements.
Choose the authentication mechanism before adding token machinery
An API does not automatically need JWT. Laravel’s authentication documentation presents custom guards as an extension point; it does not prescribe JWT for ordinary SPA or API authentication. Decide first how clients relate to your application and what the protocol must support.
As an Amazon Associate I earn from qualifying purchases.
| Need | Starting point | What to decide |
|---|---|---|
| First-party browser or SPA | Fortify with the web guard and Sanctum |
Whether requests should use Laravel’s session cookie and how the frontend will handle login and any 2FA challenge. |
| Mobile client or API access without OAuth2 requirements | Sanctum may fit | Whether a Sanctum API token meets the client and security requirements; define token handling and lifecycle for the application. |
| Third-party clients requiring OAuth2 protocol features | Passport | Which OAuth2 interoperability or grant requirements the application actually needs. |
| A system with a specific requirement unmet by these approaches | A custom guard, potentially JWT-based | Token issuance, validation, expiry, revocation, client storage, and ongoing maintenance. |
Sanctum and Passport solve different needs and can coexist with Laravel browser authentication. Laravel’s guidance generally favors Sanctum for first-party browser/SPAs and many mobile or API cases, while Passport is intended for applications that need OAuth2 features. The framework’s authentication documentation explains its custom-guard extension point and this Sanctum-versus-Passport distinction: Laravel authentication documentation.
Keep guards, providers and authentication flows distinct
Laravel’s documentation puts the key distinction plainly: “Guards define how users are authenticated for each request.” A guard describes how a request is authenticated. A provider retrieves the authenticatable user from persistent storage. A guard references a provider, so its configuration must match the identity store and request type it is intended to serve.
#1 Best Overall
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
- Guards answer how: for example, whether a request is authenticated through the application’s session or another mechanism.
- Providers answer from where: they retrieve the user record or other authenticatable identity.
- Route middleware chooses the guard: Laravel’s
authmiddleware can name a configured guard. Routes should use the guard intended for their audience and request flow.
For customer, administrator, or other separate populations, map each route group to the appropriate guard and provider. Do not assume that creating multiple guards automatically separates authorization rules or gives every authentication flow the right identity context: explicitly design those boundaries.
Fortify’s configured guard has an additional constraint: it must implement IlluminateContractsAuthStatefulGuard. That requirement matters when selecting a guard for Fortify; a custom guard that authenticates a different kind of request is not automatically suitable for Fortify’s stateful login flows. See Laravel Fortify documentation alongside the framework’s authentication documentation.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Use Fortify as the headless authentication backend
Fortify provides authentication routes and controllers rather than a frontend. Your custom UI sends requests to those routes, while Fortify supplies backend flows such as registration, password reset, email verification, and two-factor authentication. Laravel describes the arrangement this way: “If you choose to install Fortify, your user interface will make requests to Fortify’s authentication routes that are detailed in this documentation in order to authenticate and register users.”
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Identify your clients. Decide whether the frontend is a first-party browser SPA, a mobile app, or an API client outside your control.
- Choose the request authentication model. For a Fortify-powered SPA, Laravel documents the
webguard with Sanctum. Sanctum can authenticate first-party requests using Laravel’s session cookie and can also inspect an API token. - Map identities to routes. Configure each guard with the appropriate provider and attach the intended guard to its route group. Keep administrative and customer identities distinct where the application requires it.
- Build the frontend around backend states. Handle successful login, validation or authentication errors, and any response that requires the user to complete a two-factor challenge. Use the route and configuration behavior for the Fortify version installed by the application.
- Add stronger authentication deliberately. Decide whether the account should support TOTP, passkeys, or both, and provide enrollment, recovery, and fallback paths appropriate to the application.
Fortify’s 2FA detail below is documented in Laravel 11.x Fortify material, while the passkey material is from Laravel 13.x. Check the documentation corresponding to your installed package and framework version before relying on exact route or configuration behavior.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Implement Fortify’s TOTP two-factor flow as a frontend state machine
The documented Fortify 2FA feature uses TOTP: a compatible authenticator app generates a six-digit numeric code. Enrollment is not just a frontend toggle. The user enables the feature, scans a QR code, and—when confirmation is configured—must submit a valid code to complete setup. Recovery codes provide an alternate route when the authenticator device is unavailable.
- Protect changes to 2FA settings. Fortify’s default feature settings require password confirmation before a user changes those settings.
- Start enrollment and display the QR code. For an XHR frontend, the Fortify documentation describes retrieving the QR code from a dedicated endpoint. Present it only in the authenticated account-security flow.
- Confirm enrollment when configured. Ask the user to enter a current six-digit code. Treat setup as incomplete until the server accepts it when confirmation is enabled.
- Show and manage recovery codes. Retrieve recovery codes through the documented endpoint and provide a way to regenerate them. Explain that they are for regaining access if the authenticator device is lost.
- Handle the login challenge. Include a challenge state in the login flow. The frontend posts either an authenticator code or a recovery code to the challenge endpoint and responds to the result rather than treating the initial password submission as the only possible login outcome.
The cited Fortify documentation describes TOTP and recovery codes; it does not establish SMS or email as Fortify’s second factor. Consult the version-specific Fortify 2FA documentation for the relevant endpoints and feature settings.
Rank #4
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Add passkeys with the WebAuthn registration and login ceremonies
Laravel 13.x Fortify documentation describes passkey registration and login using WebAuthn. A passkey can use a platform authenticator—such as Face ID, Touch ID, or Windows Hello—or a hardware security key. A dedicated hardware key is optional; a compatible platform authenticator may already be available on the user’s device.
For a custom frontend, the client and server participate in a ceremony: request options from the backend, perform the credential operation in the browser, then submit the serialized result for server verification. The official @laravel/passkeys JavaScript package supports the browser-side ceremonies.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Meet the user-model contract. The model must implement Fortify’s
PasskeyUsercontract and usePasskeyAuthenticatable. - Set deployment-specific WebAuthn configuration. The relying-party ID and allowed origins must match the deployed domain and permitted origins. Configuration also includes a user-handle secret and operation timeout.
- Implement registration and login as separate ceremonies. Fetch the corresponding options, invoke the browser operation through the supported client package, and send the serialized result back for verification.
- Plan recovery and rate limits. Keep an account recovery path for users who cannot use a passkey. Fortify applies rate limiting to passkey routes.
Incorrect domain or origin configuration can prevent browser credentials from working on the deployed site, so configure against the real deployment rather than assuming a development origin will transfer unchanged. The specifics are in Laravel 13.x Fortify passkey documentation.
When a custom JWT guard is justified
Laravel’s authentication documentation demonstrates registering a custom jwt driver and configuring a guard to use it. That example shows how to extend the framework; it does not select a third-party JWT package, define a complete token lifecycle, or say JWT is necessary for Fortify, an API, or a multi-guard application.
Before implementing a custom token guard, write down the requirement it solves that a session, Sanctum token, or Passport’s OAuth2 features does not. Then specify how tokens are issued and validated, when they expire, how access is revoked, and where each client stores them. The documentation’s custom-driver example alone does not settle those security and operational choices. Do not label a design “JWT sessions” as if it were Laravel’s default session mode: JWT-based request authentication is a separate design decision.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Review the design before shipping
- Every protected route uses a configured guard that matches its client and identity population.
- Each guard references the provider for the intended user store.
- Fortify uses a guard that implements
StatefulGuard; for a documented SPA setup, use thewebguard with Sanctum. - The frontend can represent login challenges, TOTP enrollment confirmation, and recovery-code use where enabled.
- Passkey relying-party ID and allowed origins match the deployment, and the user model satisfies Fortify’s passkey contract.
- Passport is selected for a real OAuth2 protocol requirement, not merely because the application exposes API routes.
- A custom JWT guard has a defined token expiry, revocation, client-storage, and maintenance policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
