panelsso / pterodactyl

v1.0.0 2026-10-17 03:29 UTC

Requires

• php: ^8.2 || ^8.3
• laravel/framework: ^12.0

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.18
• orchestra/testbench: ^10.0
• phpunit/phpunit: ^11.5

MIT

• SSO
• laravel
• pterodactyl

Published on Packagist.org on 2026-10-17 03:35 UTC

README

Let your clients log into their Pterodactyl panel account with a single redirect.

PanelSSO is a Laravel package that is installed inside your Pterodactyl Panel. Your client area (billing/management app) calls one endpoint server-to-server with a shared secret, receives a one-time login URL, and sends the client's browser to it — the client lands in the panel already authenticated.

Requirements

• Pterodactyl Panel v1.15.x
• PHP 8.2 or 8.3

Installation

composer require panelsso/pterodactyl

Configuration

1. Publish the configuration file:

php artisan vendor:publish --tag=panel-sso

1. Generate a shared SSO secret (written to the panel's .env as PANEL_SSO_SECRET):

php artisan panel-sso:generate

The command prints Generated new secret key: <secret>.

1. Paste the generated key into the calling application's configuration.

Usage

From the calling application (server-side), request a one-time login URL:

$response = Http::get('https://panel.example.com/panel-sso', [
    'sso_secret' => config('services.panel_sso.secret'),
    'user_id' => $user->pterodactyl_id,
]);

if (! $response->successful() || ! $response->json('success')) {
    return back()->withErrors(['sso' => $response->json('message') ?? 'Something went wrong.']);
}

return redirect()->away($response->json('redirect'));

When the browser follows the returned redirect URL, the user is logged into the panel automatically.

Behavior

The webhook endpoint GET /panel-sso responds with JSON ({"success":true,"redirect":"<url>"} on success):

Status	Message	Meaning
403	Please configure a SSO Secret	No shared secret has been configured on the panel.
403	Please provide valid credentials	The sso_secret value is missing, malformed, or does not match.
404	User does not exist	The user_id is missing, malformed, or matches no panel account.
501	You cannot automatically login to admin accounts.	The target account is a root admin.
501	Logging into accounts with 2 Factor Authentication enabled is not supported.	The target account has TOTP enabled.
200	—	Success; the response contains the one-time redirect URL.

The login endpoint GET /panel-sso/{token} consumes the token and redirects the browser to the panel's default (or previously intended) page. If the token is invalid, expired, or already used, the browser is sent back with the flash message Token does not exists or has expired. If the account disappears or the login fails, the flash message is Something went wrong, please try again.

Security

• Root admin accounts and accounts with 2 Factor Authentication enabled can never log in via SSO.
• Login tokens are single-use, expire after 60 seconds, and carry ~285 bits of entropy (48 alphanumeric characters).
• The shared secret is compared server-to-server with a timing-safe comparison and is never exposed to the browser.

License

PanelSSO is open-source software licensed under the MIT license.