Stand-Alone Laravel Passkey Plugin
Budget: $30 – $250 USD
I need a self-contained passkey authentication plugin that follows the Botble CMS plugin structure shown here: https://docs.botble.com/cms/plugin-development/.
The target framework is Laravel 13 and the module must live entirely inside its own package so it can be dropped into any fresh Laravel install without touching the default auth scaffolding.
Scope
• The plugin must let users both register and sign in using a passkey (WebAuthn/FIDO2).
• All communication, key storage, and challenge-response flows must meet advanced security expectations—public-key cryptography, origin binding, replay protection, and encryption of any at-rest metadata.
• No fallback to passwords is required; the flow should remain passkey-only.
Deliverables
1. A clean, namespaced Laravel 13 plugin that matches Botble’s “plugin” folder layout.
2. Migration(s) and model(s) for any tables your solution needs.
3. Controllers, routes, middleware, and Blade components (or Livewire/Vue, if preferred) that expose:
• passkey registration page / endpoint
• passkey login page / endpoint
4. README with install steps, environment variables, and demo commands.
5. A short security note outlining how the advanced measures are implemented.
Acceptance
Running php artisan migrate && php artisan plugin:activate <your-plugin> on a clean Laravel 13 app must let me:
• create a new user by registering a passkey,
• log out, then log back in with that same passkey,
• see all requests complete with valid WebAuthn assertions and no console errors.
Feel free to lean on existing, well-maintained WebAuthn libraries as long as their licenses allow commercial use and the code remains modular.
The target framework is Laravel 13 and the module must live entirely inside its own package so it can be dropped into any fresh Laravel install without touching the default auth scaffolding.
Scope
• The plugin must let users both register and sign in using a passkey (WebAuthn/FIDO2).
• All communication, key storage, and challenge-response flows must meet advanced security expectations—public-key cryptography, origin binding, replay protection, and encryption of any at-rest metadata.
• No fallback to passwords is required; the flow should remain passkey-only.
Deliverables
1. A clean, namespaced Laravel 13 plugin that matches Botble’s “plugin” folder layout.
2. Migration(s) and model(s) for any tables your solution needs.
3. Controllers, routes, middleware, and Blade components (or Livewire/Vue, if preferred) that expose:
• passkey registration page / endpoint
• passkey login page / endpoint
4. README with install steps, environment variables, and demo commands.
5. A short security note outlining how the advanced measures are implemented.
Acceptance
Running php artisan migrate && php artisan plugin:activate <your-plugin> on a clean Laravel 13 app must let me:
• create a new user by registering a passkey,
• log out, then log back in with that same passkey,
• see all requests complete with valid WebAuthn assertions and no console errors.
Feel free to lean on existing, well-maintained WebAuthn libraries as long as their licenses allow commercial use and the code remains modular.