Laravel Fortify

Laravel Fortify is Laravel's official headless authentication backend, maintained by the Laravel team itself. It implements the routes and controllers for registration, login, password reset, email verification, password confirmation, and two-factor authentication, but ships no views at all, leaving the frontend entirely up to the application.

That headless design is why Fortify powers Laravel's official starter kits: the React, Svelte, Vue, and Livewire kits all use it for authentication and supply their own pages on top. It is equally the natural choice for a team that wants Laravel's official auth flows behind a custom Blade, Inertia, or SPA frontend. Two-factor authentication uses TOTP codes from any authenticator app, with recovery codes and optional confirmation before 2FA is enabled.

Because it only adds the routes and controllers Laravel Auth does not provide out of the box, Fortify builds on the framework's existing guard and provider system rather than introducing a separate one. Features are switched on and off in config/fortify.php, and user creation and password reset logic live in plain action classes inside the application, so a project can adopt just the pieces it needs, like 2FA alone.