fbpkg / laravel-creds

v0.1.0 2026-09-26 14:47 UTC

Requires

• php: ^8.2
• fbpkg/laravel-sms: ^0.1.2
• fbpkg/laravel-support: ^0.3.0
• illuminate/database: ^11.0|^12.0|^13.0
• illuminate/support: ^11.0|^12.0|^13.0

MIT

• Farzad Sharifi

Published on Packagist.org on 2026-09-26 14:49 UTC

README

Authentication credentials and OTP utilities for Laravel.

Requirements

• PHP 8.2+
• Laravel 11+
• fbpkg/laravel-support
• fbpkg/laravel-sms

Installation

Install the package via Composer:

composer require fbpkg/laravel-creds

The package service provider is automatically registered through Laravel package discovery.

Configuration

Publish the package configuration:

php artisan vendor:publish --tag=cred-config

The configuration file will be published to:

config/cred.php

You can customize:

• OTP expiration
• OTP resend interval
• OTP maximum attempts
• OTP block duration
• OTP channels and code formats
• Password history
• Password reuse prevention
• Cleanup settings
• Database table names

Database

Publish the package migrations:

php artisan vendor:publish --tag=cred-migrations

Then run the migrations:

php artisan migrate

The package uses two tables:

• otp_codes — Stores OTP codes and their verification state.
• passwords — Stores password history for authenticatable models.

Both table names can be customized through config/cred.php.

SMS Configuration

If you use the sms OTP channel, you must configure the SMS gateway through fbpkg/laravel-sms.

Make sure the required SMS panel credentials and settings are configured according to the SMS package.

You must also configure the OTP SMS pattern ID in your application's .env:

CRED_OTP_SMS_PATTERN=

The pattern configuration is available in config/cred.php:

'pattern' => [
    'id' => env('CRED_OTP_SMS_PATTERN'),

    'variable' => 'code',
],

The configured pattern must contain the variable name configured by variable so the generated OTP code can be sent correctly.

For example, with the default configuration, the SMS pattern should accept:

code

SMS Package Configuration

The SMS gateway itself is configured by fbpkg/laravel-sms.

For example, when using the default ippanel gateway, configure the required environment variables for that package before sending OTPs.

Refer to the fbpkg/laravel-sms documentation for the complete SMS gateway configuration.

OTP

OtpService handles OTP generation, delivery and verification.

Example:

use Fbpkg\Cred\Otp\Services\OtpService;

$otpService->send(
    identifier: '9120000000',
    type: 'login',
    channel: 'sms',
);

Verify the submitted code:

$result = $otpService->verify(
    identifier: '9120000000',
    type: 'login',
    channel: 'sms',
    code: '123456',
);

The result is returned as an array containing the operation status and related information:

[
    'success' => true,
    'status' => 'verified',
    'attempts_left' => 5,
    'waiting_time' => 0,
]

Possible verification statuses include:

• verified
• not_found
• used
• expired
• invalid
• blocked

Passwords

Add the HasPassword trait to your authenticatable model:

use Fbpkg\Cred\Password\Traits\HasPassword;

class User extends Authenticatable
{
    use HasPassword;
}

Set a password:

$result = $user->setPassword('your-password');

The result is returned as an array:

[
    'success' => true,
    'status' => 'set',
]

If the password cannot be reused according to the configured password history:

[
    'success' => false,
    'status' => 'reused',
]

Check the current password:

$user->checkPassword('your-password');

This returns a boolean.

Password History

The package keeps password history and can prevent users from reusing recent passwords.

Configure these options in config/cred.php:

'password' => [
    'history_limit' => 10,
    'prevent_reuse' => 5,
],

• history_limit determines how many password records are retained.
• prevent_reuse determines how many previous passwords are checked before allowing a new password.

Cleanup

Automatic cleanup is enabled by default:

'cleanup' => [
    'enabled' => true,
    'after' => '24h',
],

Cleanup removes old OTP records and other eligible package records during package operations.

Durations can be written using:

• s — seconds
• m — minutes
• h — hours
• d — days

For example:

'expires_in' => '2m',
'resend_after' => '1m',
'blocked_for' => '10m',

License

The MIT License. See the LICENSE file for details.