Laravel can run authentication in several ways: write it yourself with guards, take a starter kit, use Fortify as a headless backend, or issue API tokens with Sanctum and Passport. This lesson explains who does what and how to choose. Guards and Breeze are covered in the auth starter kits lesson.

Fortify: authentication without a UI

Fortify registers the routes and actions for login, registration, password reset, email verification and two-factor authentication. It renders nothing: you bring the views.

Layers of authentication in Laravel
Layers of authentication in Laravel
bash
composer require laravel/fortify
php artisan fortify:install
php artisan migrate

fortify:install publishes FortifyServiceProvider, config/fortify.php, the app/Actions/Fortify classes and a migration with the 2FA columns. In Laravel 12 the provider is added to bootstrap/providers.php.

php
<?php

namespace App\Providers;

use App\Actions\Fortify\CreateNewUser;
use Illuminate\Support\ServiceProvider;
use Laravel\Fortify\Fortify;