Architecture for pure API development Most official Laravel starter kits focus on full-stack development, bundling React, Vue, or Livewire. This unofficial kit strips away the web layer entirely. By removing Laravel Fortify, it eliminates the complexity of a "black box" authentication engine, giving you direct control over controller logic. It prioritizes a clean, Postman-ready experience where JSON is the only language spoken. Implementation and automation Created using Claude (specifically the Opus and Fable models), this kit demonstrates how AI can architect complex boilerplate. You can initialize a project using the standard installer: ```bash laravel new my-api --github="LaravelDaily/api-starter-kit" ``` When prompted for a starter kit, choose the custom repository option. One specific manual step remains: the installer may still ask about Node.js or NPM. Since this is a pure API, you should select **No** to ensure your environment remains free of front-end dependencies. Authentication and routing logic The kit uses Laravel Sanctum for token-based authentication. All routes are versioned under a `v1` namespace by default, reflecting professional API standards. You can view your endpoints by running `php artisan route:list`. The structure includes: * **Public Routes**: Registration, login, and password reset. * **Protected Routes**: User profile retrieval, logout, and token management. ```php // Example of the v1 Route Prefixing Route::prefix('v1')->group(function () { Route::post('/register', [AuthController::class, 'register']); Route::middleware('auth:sanctum')->get('/user', [UserController::class, 'show']); }); ``` Integrated documentation Maintaining documentation is often the first thing to fail in fast-paced projects. This kit solves that by including Scramble, which automatically generates OpenAPI documentation from your code. When you visit the root URL, the app returns a JSON response containing a link to this auto-generated documentation, ensuring your API is self-describing from day one. Strategy and best practices Avoid adding global logic to the `bootstrap/app.php` file if it only applies to specific versions. Instead, leverage the versioned controllers and form requests provided in the `App\Http\Controllers\Api\V1` namespace. This keeps your application scalable for when `V2` inevitably arrives.
Laravel Fortify
Products
Oct 2024 • 1 videos
High activity month for Laravel Fortify. Laravel among the most active voices, with 1 videos across 1 sources.
Nov 2025 • 1 videos
High activity month for Laravel Fortify. Laravel Daily among the most active voices, with 1 videos across 1 sources.
Dec 2025 • 2 videos
High activity month for Laravel Fortify. Laravel and Laravel Daily among the most active voices, with 2 videos across 2 sources.
Mar 2026 • 1 videos
High activity month for Laravel Fortify. Laravel Daily among the most active voices, with 1 videos across 1 sources.
Jun 2026 • 1 videos
High activity month for Laravel Fortify. Laravel Daily among the most active voices, with 1 videos across 1 sources.
- Jun 19, 2026
- Mar 29, 2026
- Dec 19, 2025
- Dec 4, 2025
- Nov 24, 2025
The Power of Frontend-Agnostic Authentication Laravel Fortify serves as the engine under the hood for more prescriptive starter kits like Jetstream. It handles the heavy lifting of security—authentication, registration, and two-factor logic—without forcing a specific UI on you. This makes it the premier choice when you need a custom Tailwind%20UI design or a specialized frontend framework like React or Vue without the overhead of a pre-built starter kit. Prerequisites and Installation To follow along, you should be comfortable with Laravel 10+ and PHP. You'll also need a local development environment. Start by creating a fresh Laravel project and installing the package via Composer. ```bash composer require laravel/fortify php artisan fortify:install ``` This installation publishes several actions into your `app/Actions/Fortify` directory. These are plain PHP classes that handle logic like `CreateNewUser` or `UpdateUserProfile`. Since they live in your app, you can modify them to include extra fields like phone numbers or company IDs easily. Registering Custom Views Because Fortify is "headless," it doesn't know where your login or registration templates live. You must tell Fortify which views to render using the `FortifyServiceProvider`. Inside the `boot` method, use the `Fortify::loginView` and `Fortify::registerView` methods to return your custom Blade templates. ```php Fortify::loginView(function () { return view('auth.login'); }); ``` In your login form, ensure your `action` points to the `login` route and includes a `@csrf` token. Fortify automatically handles the validation and session management once the form is submitted. Implementing Email Verification Securing your application often requires verifying user identity. First, your `User` model must implement the `MustVerifyEmail` interface. Next, enable the feature in `config/fortify.php` by uncommenting `Features::emailVerification()`. Finally, register the view in your provider: ```php Fortify::verifyEmailView(function () { return view('auth.verify-email'); }); ``` By adding the `verified` middleware to your routes, Laravel will automatically redirect unverified users to this view until they click the link sent to their inbox. Handling Password Resets Password recovery is a multi-step process. You need a view to request the reset link and another to actually set the new password. The reset view requires the current `request` object to access the unique reset token. ```php Fortify::resetPasswordView(function ($request) { return view('auth.reset-password', ['request' => $request]); }); ``` In the reset form, you must include a hidden input for the token: `<input type="hidden" name="token" value="{{ $request->route('token') }}">`. This ensures the security handshake between the email link and your database remains intact. Syntax Notes and Best Practices Fortify relies heavily on the **Action Pattern**. Instead of bloated controllers, logic is encapsulated in single-responsibility classes. When customizing, always check `config/fortify.php` first. It controls everything from rate limiting to which features are active. For local email testing, tools like HELO or Mailtrap are indispensable for catching verification and reset emails without sending them to real addresses.
Oct 2, 2024