Review the published config/laranail/authkit.php before production. Set the intended guard and user model, keep credential rate limits enabled, and configure HTTPS, secure session cookies, CSRF protection, trusted hosts/proxies, and a working mail transport in the consuming Laravel application.
Auth Kit's implemented safeguards are credential throttling by email, IP, and guard; session regeneration on login; session invalidation and CSRF-token regeneration on logout; reset/password-change revocation of personal tokens; and password-change invalidation of other compatible guard sessions. They complement—not replace—Laravel's application and deployment security configuration. Social account-linking safeguards are provided by laranail/authkit-social-login; see its social login guide.
Turnstile support is opt-in:
AUTHKIT_TURNSTILE_ENABLED=true
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=The configured challenge input is cf-turnstile-response. The rule is applied during Auth Kit user creation; attach ValidateTurnstile or TurnstileRule deliberately to other application-owned endpoints. Protect only routes where a challenge is appropriate, verify the callback server-side, and never treat the browser response as sufficient on its own.
TOTP two-factor authentication is opt-in. It encrypts TOTP and recovery secrets, rate-limits challenges, consumes recovery codes once, and relies on Fortify's replay-aware provider. Review the TOTP guide before enabling it. Also review the passkey origin requirements before deploying passkeys. See configuration for feature and guard settings, and testing for validation guidance.