GeniusAuth™ Laravel SDK

Passwordless identity for Laravel — Passkeys, WebAuthn, OAuth 2.1 & OpenID Connect

One Identity. Every Application. Zero Passwords.

Documentation · Report a bug · Request a feature

✨ Features

• Passwordless authentication — Passkeys and WebAuthn, no passwords stored
• OAuth 2.1 with PKCE — Authorization Code flow with Proof Key for Code Exchange
• OpenID Connect — ID token validation via JWKS with issuer, audience, nonce, and state verification
• Auto-discovery — Service provider and facade registered automatically
• Middleware included — Protect routes with a single geniusauth middleware alias
• Session management — Secure session-backed user identity with token storage
• Zero dependencies on passwords — Cryptographic authentication only

📦 Installation

composer require geniusauth/laravel
php artisan vendor:publish --tag=geniusauth-config

The service provider is auto-discovered by Laravel. No manual registration needed.

⚙️ Configuration

Create an application in the GeniusAuth dashboard, then set your credentials in .env:

GENIUSAUTH_ISSUER=https://auth.geniuspay.tech
GENIUSAUTH_CLIENT_ID=your_client_id
GENIUSAUTH_CLIENT_SECRET=your_client_secret
GENIUSAUTH_REDIRECT_URI=https://app.example.com/auth/genius/callback

Config options

🚀 Quick Start

1. Protect routes

Route::middleware('geniusauth')->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index']);
    Route::get('/account', [AccountController::class, 'show']);
    Route::post('/settings', [SettingsController::class, 'update']);
});

2. Trigger sign-in

use GeniusAuth\Laravel\Facades\GeniusAuth;

Route::get('/sign-in', fn () => GeniusAuth::redirect())->name('sign-in');

3. Access the authenticated user

$user = GeniusAuth::user();

// [
//     'id'     => 'usr_abc123',
//     'email'  => 'alice@example.com',
//     'name'   => 'Alice',
//     'claims' => [...all OIDC claims],
// ]

4. Logout

GeniusAuth::logout();
return redirect('/');

🔄 How it works

User                Laravel              GeniusAuth
 │                     │                     │
 │  GET /dashboard     │                     │
 │────────────────────►│                     │
 │  302 /auth/genius   │                     │
 │◄────────────────────│                     │
 │  GET /auth/genius   │                     │
 │──────────────────────────────────────────►│
 │  Passkey / WebAuthn │                     │
 │◄──────────────────────────────────────────│
 │  302 /auth/genius/callback?code=...       │
 │────────────────────►│                     │
 │                     │  POST /token        │
 │                     │────────────────────►│
 │                     │  access_token +     │
 │                     │  id_token           │
 │                     │◄────────────────────│
 │                     │  JWKS validation    │
 │                     │  session.put()      │
 │  302 /dashboard     │                     │
 │◄────────────────────│                     │
 │  200 OK             │                     │
 │────────────────────►│                     │

🛣️ Registered routes

The package automatically registers these routes:

📚 API Reference

Example: Complete controller

use GeniusAuth\Laravel\Facades\GeniusAuth;
use Illuminate\Http\Request;

class AuthController
{
    public function signIn()
    {
        return GeniusAuth::redirect();
    }

    public function dashboard(Request $request)
    {
        $user = GeniusAuth::user();

        return view('dashboard', ['user' => $user]);
    }

    public function logout()
    {
        GeniusAuth::logout();

        return redirect()->route('home');
    }
}

🔒 Security

• OAuth 2.1 Authorization Code + PKCE — No implicit flow, no client secrets in URLs
• JWKS validation — ID tokens verified against the issuer's JSON Web Key Set
• Claim verification — Issuer, audience, nonce, and state validated on every callback
• No passwords — Authentication relies exclusively on cryptography (WebAuthn) and one-time links
• Session regeneration — Token invalidation and CSRF token regeneration on logout

Never commit client secrets. Report vulnerabilities privately as described in SECURITY.md.

🧩 Compatibility

🤝 Contributing

See CONTRIBUTING.md. Please use Conventional Commits and run:

composer lint       # Pint formatting check
composer analyse    # PHPStan static analysis
composer test       # PHPUnit test suite

📄 License

GeniusAuth Laravel SDK is open-sourced software licensed under the MIT license.

© 2025 GENIUS GROUPS SAS — Built in Côte d'Ivoire 🇨🇮 · Designed for Africa · Ready for the World