Config reference

Everything lives in config/passwordless.php. Publish it with the install wizard or php artisan vendor:publish --tag="passwordless-config".

At a glance

Keys with no .env column are arrays or class names — edit the published config file.

type

Which flow(s) to register. This one is not merely informational: routes for a disabled flow are never registered.

'type' => 'both', // 'magic_link' | 'login_code' | 'both'

See Routes.

ttl

How many minutes a magic link or login code stays valid after being issued. Shared by both flows, and passed to the email templates as $expiresMins.

'ttl' => 15,

For the code flow it doubles as the decay window on the failed-attempt rate limiter.

code

Settings specific to the login code flow.

'code' => [
    'length'  => 6,            // Number of characters in the code
    'charset' => '0123456789', // Characters to draw from
],

Alphanumeric codes, with the easily-misread characters left out:

PASSWORDLESS_CODE_LENGTH=8
PASSWORDLESS_CODE_CHARSET=ABCDEFGHJKLMNPQRSTUVWXYZ23456789

guard

The authentication guard the user is logged in on.

'guard' => 'web',

user_model

The authenticatable class looked up by email address.

'user_model' => \App\Models\User::class,

PASSWORDLESS_USER_MODEL=App\Models\Member

The model needs the HasPasswordlessAuth trait and Laravel's Notifiable.

remember

Whether to create a persistent "remember me" session on a successful passwordless login. Passed straight through as the second argument to Auth::guard()->login().

'remember' => false,

rate_limits

'rate_limits' => [
    'send'   => 5, // max send requests per IP + email, per minute
    'verify' => 5, // max failed code attempts per email, per TTL window
],

See Security for what each one actually counts and what it does not cover.

redirects

Where the user ends up.

'redirects' => [
    'after_login'   => '/dashboard',
    'invalid_token' => '/login',
],

Both are paths handed to redirect()->to(), not route names.

routes

Prefix and middleware for every route the package registers.

'routes' => [
    'prefix'     => 'auth',
    'middleware' => ['web'],
],

See Routes.

views

Override any built-in view. null uses the package default.

'views' => [
    'magic_link_request' => null,  // GET /auth/magic-link
    'magic_link_sent'    => null,  // after POST /auth/magic-link
    'magic_link_email'   => null,  // email notification
    'login_code_request' => null,  // GET /auth/code
    'login_code_verify'  => null,  // GET /auth/code/verify
    'login_code_email'   => null,  // email notification
],

See Blade views.

inertia and components

'inertia' => false,

'components' => [
    'magic_link_request' => null, // e.g. 'Auth/MagicLinkRequest'
    'magic_link_sent'    => null,
    'login_code_request' => null,
    'login_code_verify'  => null,
],

When inertia is true, components takes precedence over views for the four page views. The two email templates stay Blade either way. See Inertia.

actions

The five swappable pieces of the flows.

'actions' => [
    'generate_magic_link'     => GenerateMagicLinkAction::class,
    'authenticate_magic_link' => AuthenticateViaMagicLinkAction::class,
    'generate_login_code'     => GenerateLoginCodeAction::class,
    'authenticate_login_code' => AuthenticateViaLoginCodeAction::class,
    'resolve_user'            => ResolveUserForSendAction::class,
],

All contracts live in Torqie\LaravelPasswordless\Contracts. See Swapping actions.