statikbe / laravel-google-authenticate

5.0.0 2026-11-10 06:51 UTC

Requires

• illuminate/routing: ^10.0|^11.0|^12.0|^13.0
• illuminate/support: ^10.0|^11.0|^12.0|^13.0
• laravel/socialite: ^5.18

Requires (Dev)

• laravel/pint: ^1.32
• orchestra/testbench: ^8.0|^9.0|^10.0|^11.0
• pestphp/pest: ^2.34|^3.0|^4.0

Suggests

• doctrine/dbal: If you are using the provided migration you will need doctrine/dbal. You won't need this in Laravel versions >= 11

MIT

• Kristof Serré
• Kobe Christiaensen

• google
• laravel
• authenticate
• socialite

Published on Packagist.org on 2026-11-10 06:52 UTC

README

Google Authenticator

This module gives you the option to let you (and your users) log in with their Google account on your Laravel application.

This is initially used to let only people log in from certain workspaces. But can be enabled to let everyone log in.

Changelog - Upgrade guides

Installation

Using Composer

composer require statikbe/laravel-google-authenticate

Usage

The package will automatically register itself.

You can publish the migration with the following command:

php artisan vendor:publish --provider="Statikbe\GoogleAuthenticate\GoogleAuthenticateServiceProvider" --tag="google-migrations"

To add the needed columns to your database run:

php artisan migrate

Add the use HasGoogleAuth trait in your User.php class. HasGoogleAuth makes provider and provider_id mass-assignable. Because of that, never grant roles or privileges based on the provider column: use the GoogleUserRegistered event (see below), which only fires after all login checks passed.

In your .env file you should include the following keys:

GOOGLE_CLIENT_ID="YOUR_GOOGLE_CLIENT_ID"
GOOGLE_CLIENT_SECRET="YOUR_GOOGLE_CLIENT_SECRET"
CALLBACK_URL_GOOGLE="https://www.domain.com/login/google/callback"

The next step is to add the following lines in your services.php config file

'google' => [
        'client_id' => env('GOOGLE_CLIENT_ID'),
        'client_secret' => env('GOOGLE_CLIENT_SECRET'),
        'redirect' => env('CALLBACK_URL_GOOGLE'),
    ],

Info on how to create a Google Auth Client id and secret can be found on their documentation page.

Finally, you can add google login route to your login and register views: {{ route('google.auth.login') }}.

Config

Publish the config file

php artisan vendor:publish --provider="Statikbe\\GoogleAuthenticate\\GoogleAuthenticateServiceProvider" --tag="google-config"

Email domains

You can change the email domains that can login using Google. The three available options are:

• allowed-array: only the domains in this array can login using Google
• disabled-array: domains in this array can not login using Google
• Empty / null: all domains can use the Google login

When allowed is set, the Google account must also carry a matching hosted domain (hd claim). Only Google Workspace accounts have one, so personal Gmail accounts are refused even with an allowed email domain. Google accounts with an unverified email are always refused.

The domain rules apply to existing users too, not only to new registrations. When register_enabled is false, only existing users can log in, and only with a verified Google email.

    'domains' => [
        //'allowed' => ['statik.be'],
        //'disabled' => ['google.com'],
    ],

You can add an extra middleware on the auth logins by adding them in the google-authenticate.php config file.

Linking existing users

A user row that already exists with the same email, but without a Google account, is linked on first Google login only when the Google hd claim equals the email domain, or the email is on gmail.com / googlemail.com. Otherwise the login is refused. When linked, the row's password is set to null (if the column exists) and its remember_token is rotated, so credentials set before the link stop working.

Events

Statikbe\GoogleAuthenticate\Events\GoogleUserRegistered is dispatched when a brand-new user row was created by a Google login that passed every check (verified email, domain rules, hd). It carries $user (the model), $googleUser (the Socialite user) and $hostedDomain (the hd claim, lowercased; empty when none was sent and no allowed list is set). It fires before the login, never when linking an existing row or on later logins. If a listener throws, the login fails. Use it to grant roles, never model events or mass-assigned columns:

Event::listen(GoogleUserRegistered::class, function (GoogleUserRegistered $event) {
    if ($event->hostedDomain === 'statik.be') {
        $event->user->assignRole('super-admin');
    }
});

Laravel Boost skill

The package ships a Laravel Boost skill, google-authenticate-upgrade, that walks an agent through upgrading a 3.x/4.x project to 5.0. Boost discovers it from resources/boost/skills of your installed packages: run php artisan boost:install (first time) or php artisan boost:update (after updating this package), select the skill, then ask your agent to upgrade Google Authenticate. The skill also audits role/super-admin grants, HasPanelShield, self-service account deletion and seeders. Boost only offers skills of direct composer requirements. Boost is not a dependency of this package.

Remember me

Logins are not remembered by default. Set 'remember' => true in the config to issue a remember-me cookie.

Custom middlewares

    'middleware' => [
        'web',
        CustomMiddleware::class
    ], 

User table

You can customize how a user is saved. The config array user_columns will create the fillable data for your user. The array keys are your user column names, the array values are what should be stored. (Make sure the value is an array). You can add multiple values per key, these will be glued together. The following values would be filled by google's returned data, before being glued.

const GOOGLE_VALUES = [
        'name',
        'email_verified',
        'email',
        'given_name',
        'family_name',
        'picture',
        'nickname',
        'locale',
];

For example in your config:

'user_columns' => [
        'name' => ['name', ' (', 'locale', ')']     // John Doe (en)
        'email_verified_at' => ['email_verified'],  // 2019-10-23 14:31:50
        'email' => ['email'],                       // [e-mail]
        'other data' => ['blablabla'],              // blablabla
]

Publishing

You can publish the views and translations files using:

php artisan vendor:publish --provider="Statikbe\\GoogleAuthenticate\\GoogleAuthenticateServiceProvider" --tag="google-views"

and

php artisan vendor:publish --provider="Statikbe\\GoogleAuthenticate\\GoogleAuthenticateServiceProvider" --tag="google-lang"

Security

If you discover any security related issues, please email [e-mail] instead of using the issue tracker.

License

The MIT License (MIT). Please see License file for more information.