Laravel Fortify provides a robust, backend implementation for authentication in Laravel applications. It handles features like two-factor authentication, password confirmation, and session management without forcing a specific frontend UI.
By using Fortify, teams can ship secure authentication faster while keeping full control over the presentation layer and user experience.
| Feature | Description | Benefit | Best For |
|---|---|---|---|
| Two-Factor Authentication | Time-based one password (TOTP) support with recovery codes | Stronger account security for sensitive apps | Admin panels, SaaS platforms, fintech |
| Password Confirmation | Requires current password for critical actions | Protects against unauthorized privilege changes | Billing, security settings, profile updates |
| API Token Management | Fortify issues personal access tokens via the User modelSecure API authentication without third-party packages | Headless apps, mobile backends, SPA dashboards | |
| Session Management | Revokes sessions on password changes or logout | Reduces risk from compromised credentials | Multi-device environments, enterprise security |
Implementing Laravel Fortify in New Projects
Project Setup and Configuration
Install Laravel Fortify via Composer and publish its assets to customize validation rules and views. You wire Fortify to your User model and choose features such as two-factor authentication, email verification, and password reset.
Because Fortify is headless, you build or use your own frontend while Fortify handles routes, request validation, and security logic. This keeps your stack lightweight and avoids forcing a specific UI package.
Use config files and service providers to enable only the features you need, reducing attack surface and keeping your application fast.
Authentication Logic and Security
How Fortify Handles User Registration and Login
Fortify registers controllers internally and exposes configuration options for registration, password reset, and email verification. You can disable registration entirely or customize the behavior using callback hooks.
It leverages Laravel’s built-in authentication guards and rate limiting to protect login and registration endpoints. This means familiar concepts like Auth::login(), middleware, and throttle work seamlessly with Fortify.
Security decisions such as password hashing, confirmation requirements, and session handling stay within Fortify, allowing consistent enforcement across web and API contexts.
Two-Factor Authentication Setup and Management
Enabling and Using 2FA with Fortify
Fortify adds two-factor authentication support using TOTP and recovery codes. You enable it in the configuration and attach 2FA views and routes to your chosen frontend.
Once enabled, users can enable two-factor authentication from their profile page, scan a QR code with an authenticator app, and store recovery codes securely. Fortify manages the backend logic so you do not have to implement safe token generation and verification.
You can require 2FA for specific roles or all users, and combine it with session management to revoke active sessions on device changes.
API Token Management and Integration
Issuing and Revoking Personal Access Tokens
Fortify allows users to create personal access tokens through your application’s settings page or API. Tokens are stored encrypted and tied to the authenticated user for permission checks.
You can limit token abilities, set expiration windows, and integrate with Sanctum or custom guards to control API access. Revoking tokens invalidates future requests while keeping existing sessions independent unless you configure cascading logout.
This approach works well for headless applications, mobile backends, and service-to-service communication where traditional cookie sessions are not ideal.
Best Practices and Next Steps with Laravel Fortify
- Enable only the authentication features your application actually needs to reduce complexity and attack surface.
- Use HTTPS everywhere and enforce secure, same-site cookie settings for session-based authentication.
- Require two-factor authentication for privileged accounts and sensitive operations.
- Customize validation messages and rate limits to match your application’s policies and user experience goals.
- Integrate Fortify with Laravel Sanctum or Jetstream when you need API tokens or a more complete UI scaffolding.
- Regularly review token usage and session logs to detect unusual access patterns early.
FAQ
Reader questions
How do I enable two-factor authentication with Laravel Fortify?
Publish the Fortify configuration, enable two-factor authentication in the config, add the Fortify two-factor views to your frontend, and wire the backend routes for enabling and confirming 2FA actions.
Can I use Laravel Fortify without any frontend UI package?
Yes, Fortify is headless by design. You can build your own frontend forms and API calls while Fortify processes registration, login, password reset, and token management securely in the backend.
What happens to existing sessions when a user changes their password?
By default, Fortify revokes all user sessions when the password is changed or the account email is updated, which prevents unauthorized access from previously logged-in devices.
How can I limit two-factor authentication to administrators only?
You can gate 2FA routes using Laravel policies or middleware that checks the user’s role, enabling two-factor features only for admins or specific user groups.