jeremykenedy/laravel-auth: A Laravel 12 Authentication Scaffold with Roles, Profiles and Socialite

What laravel-auth actually is, and who it is for

The README describes it as "a Complete Build of Laravel 12 with Email Registration Verification, Social Authentication, User Roles and Permissions, User Profiles, and Admin restricted user management system", built on Bootstrap 4. That wording matters. This is not a library you require into an existing project. It is an application you clone and then own, views and all. The repository root contains artisan, app/, config/, database/, resources/, routes/ and tests/, which is the layout of a Laravel application rather than a package.

The intended user is someone starting a Laravel product that needs accounts on day one: registration with email confirmation, password recovery, captcha protection, social logins, roles and permissions, user profiles, and an admin area for managing users. The README claims the project can be stood up in minutes, and the feature list is unusually broad for a starter: Google Maps API v3 for user location lookup and geocoding, CRUD for both themes and users, admin log viewing through Monolog, localization files, and a two-step authentication option. Each of those is code you would otherwise write yourself.

The trade-off is that you inherit decisions. Bootstrap 4 is the view layer, MySQL is the default database, and the admin surfaces ship with the application rather than as optional modules. If your product does not want a themes CRUD or a geocoding field on the profile, you are deleting code, not declining a dependency.

How the authentication flow is put together

The README states that the project "makes full use of Controllers for the routes, templates for the views, and makes use of middleware for routing". That is the architecture in one sentence: routes point at controllers, controllers render Blade templates, and middleware gates the routes that require a session or a role. There is no separate auth service layer to learn.

Two mechanisms are worth calling out because they are configured rather than hardcoded. Activation is controlled from the environment file: ACTIVATION=true turns email confirmation on, ACTIVATION_LIMIT_TIME_PERIOD=24 and ACTIVATION_LIMIT_MAX_ATTEMPTS=3 bound how often an activation can be retried, and NULL_IP_ADDRESS=0.0.0.0 is the fallback used when the signup request has no usable IP. The README also lists "Capture IP to users table upon signup" and "Restrict User Email Activation Attempts" as features, so the database row carries the signup IP and the retry window is enforced server side.

Social logins run through Laravel Socialite, and the README points to a section on obtaining API keys and another on adding more providers. Two-step authentication is a separate flag: LARAVEL_2STEP_ENABLED=false by default, with LARAVEL_2STEP_DATABASE_CONNECTION=mysql and LARAVEL_2STEP_DATABASE_TABLE=laravel2step, so the second factor stores its state in its own table rather than on the users table. User management settings are also environment-driven, including USER_RESTORE_CUTOFF_DAYS=31 for restoring deleted accounts and USER_LIST_PAGINATION_SIZE=50 for the admin list.

Installing laravel-auth and getting a first login

The README links a full XAMPP and localhost guide in INSTALLATION.md, and the .env.example carries comments for both paths. The commands below follow the repository's own files: Composer for PHP dependencies, the npm scripts from package.json for assets, and Artisan for the database. The README also documents a Mix build step and an optional cache build.

Start by installing dependencies and creating your environment file from the example, then generate the application key:

composer install
cp .env.example .env
php artisan key:generate

Edit .env before migrating. The example sets DB_CONNECTION=mysql, DB_HOST=127.0.0.1, DB_PORT=3306, DB_DATABASE=laravel_auth and DB_USERNAME=root, with DB_PASSWORD empty for a default XAMPP install. APP_URL is http://localhost:8000 for php artisan serve, and the file notes that XAMPP users should instead point it at http://localhost/laravel-auth/public.

Email is the part people get wrong first. The example ships MAIL_MAILER=smtp against smtp.mailtrap.io on port 2525, and comments that you can set MAIL_MAILER=log to write messages into storage/logs during local development. Since ACTIVATION=true, registration will not complete without a working mail path.

php artisan migrate --seed
npm install
npm run dev

The seed step matters. The README documents seeded roles, seeded permissions, seeded users and a themes seed list, so the admin account you log in with comes from the seeder rather than from the registration form. Read the Seeds section of the README for the credentials it creates before you point a browser at the app. For a production asset build, package.json defines npm run prod, which runs lint, prettier and a Vite build with a raised Node heap.

Where laravel-auth is the wrong choice

The clearest limitation is structural: this is a fork-and-own application, not a package. If you already have a Laravel application and want to add authentication to it, cloning this means merging two codebases. The README does not describe a supported path for installing laravel-auth into an existing app, and the repository layout gives no indication that one exists.

The second limitation is the front end. Bootstrap 4 is explicit in the description, and the views are Blade templates you are expected to edit. If your product is built on Tailwind, on a Vue or React SPA, or on a design system your team already maintains, you are rewriting the presentation layer. The related searches around laravel auth ui are a reasonable signal that people arrive expecting a drop-in UI layer, and this project is not that.

The third is scope. Themes CRUD, Google Maps geocoding on the profile, and admin log viewing are in the box whether or not you want them. Every one of those is code you must understand before you can safely remove it, because routes, controllers and middleware reference each other. A smaller starter gives you less to delete.

Finally, the README does not document rollback or disable procedures for the optional subsystems. There is no described way to turn off two-step authentication for users who have already enrolled, and no documented migration path if you later remove the themes tables. Treat those choices as one-way until you verify otherwise in the code.

Laravel Breeze and the package-first alternative

The most direct alternative is Laravel Breeze, which the search data shows people comparing against this project. The difference is one of packaging. Breeze is installed into an existing Laravel application through Composer and Artisan, publishes a minimal set of auth views, and leaves the rest of your application untouched. laravel-auth is a whole application: you start from it rather than adding it.

That changes what you spend your first day on. With Breeze, the first day is wiring your own domain models around a thin auth layer. With laravel-auth, the first day is reading the seeded roles and permissions, deciding which admin screens to keep, and adjusting Bootstrap 4 templates to your brand. Neither is better in the abstract; they suit different starting points.

There is also a sibling project worth knowing about. The README notes that if you like this, you will love Laravel Auth Spa, described as having configurable providers from an admin panel. That is the author's own next step for teams that want provider configuration through a UI rather than through environment variables and Socialite keys. If you are choosing between the two, the deciding question is whether you want your auth providers editable at runtime by an administrator.

Maintenance, upgrades and the MIT licence

The repository is not archived, and the last push was on 2026-09-07. Recent releases show the project tracking Laravel itself: v11.0.0 is labelled "Laravel 12 Update" and was published on 2025-10-21, with v11.1.0 following the same day. The release before that, v10.5.0, dates from 2023-04-15. The gap between those two lines is the honest picture of the upgrade rhythm: long quiet periods, then a jump when a new Laravel major lands.

That rhythm defines your upgrade cost. Because this is an application rather than a dependency, a Laravel major release means re-basing your customizations onto a new version of the scaffold. If you have heavily edited the Blade templates and the admin controllers, that merge is manual work. The README has an Updates section, so the author documents the intended path, but the practical cost scales with how far you have diverged from the upstream views.

On licensing, the repository is MIT, and the README carries a "Laravel Auth License" section. MIT is permissive and places few conditions on commercial use, but it covers this project's code only. Your application also pulls in Laravel, Bootstrap, Socialite, Google reCaptcha, Google Maps, Monolog and the rest of the dependency tree, each under its own terms. Review those separately; nothing here is legal advice. Note too that the README asks for sponsorship and states the project costs $22 a month to host. That is a request, not a licence term, and it does not change your MIT rights.

Editorial conclusion

Adopt jeremykenedy/laravel-auth when you want a working Laravel 12 application with registration, email activation, roles, permissions, profiles and an admin user manager already wired, and you accept Bootstrap 4 views you will edit directly. Do not adopt it if you need a Composer package to drop into an existing Laravel app, if your front end is Vue or React, or if you want a small auth layer you fully control; Laravel Breeze is the smaller starting point. Before committing, verify three things yourself: that the seeded roles and permissions match the access model you need, that your mail configuration actually delivers the activation email, and how the two-step authentication settings in .env.example interact with your session driver, since the README does not document rollback for that feature.

Frequently asked questions

Official sources

1. jeremykenedy/laravel-auth on GitHub
2. License: MIT
3. Project website
4. README
5. Releases