Sign-in and accounts

The admin comes with everything people need to sign in: passwords and password resets, two-factor authentication, passkeys and invitations for new users. It is built on Laravel Fortify, Laravel's sign-in package, and its screens live under the admin prefix:

URL	Screen
/lynx/login	Sign in, with email and password or a passkey.
/lynx/forgot-password	Email a reset link.
/lynx/two-factor-challenge	The code from an authenticator app, or a recovery code.
/lynx/invitation/{token}	An invited user chooses a password.
/lynx/account/security	Password, two-factor authentication and passkeys.

There is no registration. Superusers invite people. The first superuser comes from php artisan lynx:install, which asks for their name, email and password, or from php artisan lynx:superuser at any time (see Installation).

Who signs users in

LYNX_ADMIN_AUTH decides:

Value	Sign-in	Invitations and Account security
auto (default)	Lynx's screens above, unless your app has its own config/fortify.php; then as app.	Yes
app	Your app's Fortify screens, for everyone. Lynx registers no Fortify routes of its own.	Yes
false	Neither: your app signs users in its own way, such as single sign-on.	No

A site where visitors sign up

A site with a members area, bookings or surveys lets visitors create accounts. Use your app's Fortify for that, with registration on, and Lynx switches to app by itself once config/fortify.php exists:

• Everyone signs in at your app's /login, staff included. A staff member who opens /lynx while signed out goes to /login and comes back to the admin afterwards.
• People who sign up get the guest role, so they see the site and never the admin (see People who sign up).
• Superusers still invite staff from Access > Users. The invitation link opens Lynx's screen to choose a password, which then signs them in.
• Account security stays in the admin's user menu. It offers two-factor authentication only when your Fortify config turns Features::twoFactorAuthentication() on, since your sign-in is what asks for the code. Passkeys follow Features::passkeys() the same way.

Invitations

Under Access > Users, a superuser fills in a name, an email and roles, then Send invitation. Lynx creates the user with an unusable password, gives them the roles and emails a link to choose a password. The link works for 7 days (lynx-admin.auth.invitation_days). Once they choose a password, they are signed in.

Until they choose a password, the Users screen marks them Invitation pending. Resend invitation emails a new link, and the old one stops working.

The email needs a working mail setup in your app.

Your user model

Users stay your app's: Lynx uses the model of the users auth provider. For each feature:

Feature	Needs
Sign in, password reset	Illuminate\Foundation\Auth\User and the Notifiable trait.
Invitations	An Eloquent model with name, email and password.
Two-factor authentication	Fortify's TwoFactorAuthenticatable trait.
Passkeys	Fortify's PasskeyAuthenticatable trait and the PasskeyUser contract.

use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Fortify\Contracts\PasskeyUser;
use Laravel\Fortify\PasskeyAuthenticatable;
use Laravel\Fortify\TwoFactorAuthenticatable;

class User extends Authenticatable implements PasskeyUser
{
    use Notifiable, PasskeyAuthenticatable, TwoFactorAuthenticatable;
}

Lynx's migration adds the two-factor columns to users and creates the passkeys table when they are missing. Without the traits, the account screen shows only the password section.

Two-factor authentication

On Account security, Turn on shows a QR code and a setup key. Two-factor authentication counts only once a code from the app confirms it. The recovery codes are shown then; each signs you in once if you lose your phone.

Passkeys

Add passkey registers the device's passkey (fingerprint, face or PIN). The sign-in screen then offers Sign in with a passkey. Passkeys need HTTPS (or localhost) and APP_URL set to the site's address.