raheemstan/phoenix-verifier

OTP, Passwordless Login and Verification Package for Laravel

dev-main 2026-06-23 19:03 UTC

Requires

• php: ^8.2
• illuminate/mail: *
• illuminate/notifications: *
• illuminate/support: ^13.15

Requires (Dev)

• orchestra/testbench: ^11.1

MIT

• Michael Raheem

Published on Packagist.org on 2026-08-13 04:20 UTC

README

A powerful, extensible verification package for Laravel.

Phoenix Verifier provides:

• OTP Verification
• Passwordless Login (Magic Links)
• Email Verification
• SMS Verification
• WhatsApp Verification
• Rate Limiting
• Verification Events
• Multi-Provider Architecture

Built for modern Laravel applications with a focus on flexibility, security, and developer experience.

Features

OTP Verification

Generate, send, and verify one-time passwords.

Supported channels:

• Email
• SMS
• WhatsApp

Passwordless Login

Generate secure magic links and verify them without passwords.

Security Features

• Hashed OTP storage
• Hashed magic link tokens
• Expiration support
• Attempt limiting
• Rate limiting
• One-time verification

Events

Listen for:

• OTP Generated
• OTP Sent
• OTP Verified
• OTP Failed
• Magic Link Generated
• Magic Link Sent
• Magic Link Verified
• Magic Link Failed

Extensible Drivers

Supported providers:

SMS

• Termii
• Twilio
• Custom Drivers

WhatsApp

• Termii
• Twilio
• Meta Cloud API
• Custom Drivers

Requirements

• PHP 8.2+
• Laravel 11+
• Laravel 12+

Installation

Install via Composer:

composer require raheemstan/phoenix-verifier

Publish configuration:

php artisan vendor:publish --tag=phoenix-verifier-config

Publish migrations:

php artisan vendor:publish --tag=phoenix-verifier-migrations

Run migrations:

php artisan migrate

Configuration

Configuration file:

config/phoenix-verifier.php

Example:

return [

    'otp_length' => 6,

    'otp_expiry' => 300,

    'max_attempts' => 5,

    'rate_limit' => [

        'per_minute' => 3,

        'per_hour' => 10,

    ],

    'passwordless' => [

        'expires_in' => 15,

    ],

    'drivers' => [

        'sms' => env(
            'PHOENIX_SMS_DRIVER',
            'termii'
        ),

        'whatsapp' => env(
            'PHOENIX_WHATSAPP_DRIVER',
            'termii'
        ),

    ],

];

Basic Usage

Import:

use Raheemstan\PhoenixVerifier\Facades\PhoenixVerifier;

Generate OTP

Generate an OTP without sending it.

$otp = PhoenixVerifier::generateOtp(
    recipient: '[email protected]',
    channel: Channel::EMAIL,
    purpose: Purpose::LOGIN
);

Send OTP

Generate and send an OTP.

PhoenixVerifier::send(
    recipient: '[email protected]',
    channel: Channel::EMAIL,
    purpose: Purpose::LOGIN
);

Verify OTP

$isValid = PhoenixVerifier::verifyOtp(
    recipient: '[email protected]',
    channel: Channel::EMAIL,
    purpose: Purpose::LOGIN,
    code: '123456'
);

Passwordless Logins

Send Magic Link

PhoenixVerifier::sendMagicLink(
    email: '[email protected]',
    redirectUrl: route('magic-login')
);

The user receives:

https://your-app.com/magic-login?token=...

Verify Magic Link

$verification = PhoenixVerifier::verifyMagicLink(
    $request->token
);

Example:

if (! $verification) {
    abort(403);
}

$email = $verification->recipient;

The package verifies the token but does not authenticate users automatically.

Authentication remains the responsibility of your application.

Package Events

OTP Events

OtpGenerated
OtpSent
OtpVerified
OtpFailed

Example:

Event::listen(
    OtpVerified::class,
    function ($event) {

        logger()->info(
            'OTP verified'
        );
    }
);

Magic Link Events

MagicLinkGenerated
MagicLinkSent
MagicLinkVerified
MagicLinkFailed

SMS Drivers

Configure SMS provider:

PHOENIX_SMS_DRIVER=termii

Supported values:

termii
twilio

WhatsApp Drivers

Configure WhatsApp provider:

PHOENIX_WHATSAPP_DRIVER=termii

Supported values:

termii
twilio

Extending Drivers

Create your own SMS driver:

use Raheemstan\PhoenixVerifier\Drivers\Sms\SmsDriverInterface;

class MySmsDriver implements SmsDriverInterface
{
    public function send(
        string $recipient,
        string $message,
        array $meta = []
    ): bool {

        return true;
    }
}

Register the driver through your application service provider.

Security

Phoenix Verifier stores:

• OTPs as hashes
• Magic link tokens as hashes

The original values are never stored in plain text.

Testing

Use Laravel's notification fake:

Notification::fake();

PhoenixVerifier::send(
    recipient: '[email protected]',
    channel: Channel::EMAIL,
    purpose: Purpose::LOGIN
);

Notification::assertSentTimes(
    OtpNotification::class,
    1
);

Roadmap

Current

• OTP Verification
• Email Delivery
• Passwordless Login
• Rate Limiting
• Events

Upcoming

• SMS Providers
• WhatsApp Providers
• Queue Support
• Verification DTOs
• Cleanup Command
• Verification Analytics

Contributing

Contributions are welcome.

Please open an issue or submit a pull request.

License

MIT License.