To add passkeys to a Laravel app, enable Features::passkeys() in Fortify, make your User model implement PasskeyUser, set the relying party ID and allowed origins, and call Fortify’s passkey routes from the browser using the official @laravel/passkeys client. Laravel’s own documentation puts it plainly: “Fortify supports passkey authentication using WebAuthn.” This guide walks through that stack, the request flow, and what “passwordless” does and doesn’t cover. It follows the Laravel 13.x documentation and is based on that documentation, not on a hands-on deployment.
What the official stack consists of
Laravel’s April product update (published May 1, 2026) describes passkeys as a first-class part of the stack. Three pieces work together:
laravel/passkeyshandles server-side WebAuthn. See the repository.- Laravel Fortify integrates the feature through
Features::passkeys(), registering routes and controllers. Fortify is headless, so you supply the UI. @laravel/passkeysis the JavaScript client that runs the browser ceremonies, with helpers for React, Vue and Svelte.
The primary reference is the Fortify 13.x documentation. Note that this is Laravel’s product documentation, not an independent security evaluation. The broader authentication docs describe Fortify as a headless backend for browser session authentication. Passkeys here are a session-login mechanism and are separate from Sanctum or Passport API tokens.
Setup, step by step
1. Enable the feature
Add Features::passkeys() to the features list in config/fortify.php. The feature has a confirmPassword option that controls whether a user must confirm their password before registering or deleting a passkey. Leaving that on means a hijacked, unattended session can’t silently add a new passkey.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Prepare the User model
The model must implement LaravelFortifyContractsPasskeyUser and use the LaravelFortifyPasskeyAuthenticatable trait.
3. Configure the relying party
In config/fortify.php set:
- the relying party ID, which must match your application’s domain;
allowed_origins, listing the browser origins permitted to perform ceremonies;- the secret used for the opaque user handle, and the operation timeout.
When you use Fortify, its settings override the wrapped package’s configuration. Passkeys are bound to the relying party ID, so use your real production domain and origin setup, and treat changing it later as a migration risk rather than a tweak.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
4. Register a passkey from the browser
GET /user/passkeys/optionsreturns the creation options.- Pass them to
navigator.credentials.create(...). POST /user/passkeyswith the serialized credential and a user-visiblename.
With the official client, this is Passkeys.register({ name: ... }).
5. Sign in with a passkey
GET /passkeys/login/options.- Pass the options to
navigator.credentials.get(...). POST /passkeys/loginwith the returned credential. The request may include arememberboolean.
The client equivalent is Passkeys.verify(). If you prefer, call the package’s browser API directly or use its React, Vue or Svelte helpers.
Recommended Free Tools
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Confirm a session and delete passkeys
- Re-confirm an authenticated session with
GET /passkeys/confirm/optionsthenPOST /passkeys/confirm. - Delete with
DELETE /user/passkeys/{passkey}.
7. Plan for rate limiting
Fortify applies a dedicated passkeys rate limiter to login, confirmation and registration routes, and the docs describe how to customize it. Check that its limits suit your traffic before launch.
Endpoint summary
| Task | Options request | Browser call | Submit |
|---|---|---|---|
| Register | GET /user/passkeys/options | navigator.credentials.create() | POST /user/passkeys (credential + name) |
| Sign in | GET /passkeys/login/options | navigator.credentials.get() | POST /passkeys/login (optional remember) |
| Confirm session | GET /passkeys/confirm/options | navigator.credentials.get() | POST /passkeys/confirm |
| Delete | not applicable | not applicable | DELETE /user/passkeys/{passkey} |
The confirmation row’s browser call is not spelled out separately in the summary source; it uses the same assertion style as sign-in, so use the official client’s helpers rather than hand-rolling it.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the WebAuthn ceremony fits in
WebAuthn is the browser API underneath. Each ceremony has the same shape: Laravel issues options, the browser asks the authenticator to create or assert a credential, and Laravel verifies what comes back. The W3C’s Level 4 working draft (dated September 15, 2026) describes a discoverable credential as one usable when the relying party does not supply credential IDs to navigator.credentials.get(). That is what lets a user sign in without typing a username first. Since Level 4 is a draft, treat draft-specific terminology as subject to change.
Which authenticators work
Laravel lists Face ID, Touch ID, Windows Hello and hardware security keys as examples. A hardware key is optional: built-in platform authenticators are enough for most users, and offering both gives people a fallback if a device is lost. No particular key model is endorsed by Laravel’s documentation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Choosing your implementation route
| Decision | Option A | Option B |
|---|---|---|
| Integration | Existing Fortify or starter-kit setup: enable the feature and wire UI | Custom authentication backend: use laravel/passkeys directly |
| Frontend | Official @laravel/passkeys helpers (React, Vue, Svelte) |
Custom code calling the browser API and the endpoints above |
| Domain | Single production domain as relying party ID | Multiple origins listed in allowed_origins under one relying party ID |
Fortify and the browser client are complementary parts of one official path, not competing options.
What “passwordless” does not settle
The documented feature adds passkey authentication; it does not by itself remove passwords from your app or design account recovery for you. Decide deliberately:
- whether existing password login stays enabled alongside passkeys, since any remaining password path is still an attack surface;
- how a user who loses every device regains access, and how that recovery path is protected;
- whether to require users to register more than one passkey, and how you name them so they can tell which to delete.
The documentation does not prescribe answers, so these are product and security decisions for your team. Laravel also publishes no adoption or security statistics for this feature, so avoid quoting numbers about it without an original source.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
