Laravel Authentication 12

Apply the Laravel 12 prompt and its PHP 8.4 baseline first. These rules cover Laravel 12 guards, providers, authenticated sessions, authorization, and account recovery, plus optional Sanctum 4.3.3 and Fortify 1.40.0 integrations. The passkey rules apply to Fortify with the laravel/passkeys PHP package 0.2.1.

Guards, providers, and login decisions

• Select guards, providers, authenticatable models, and password brokers from trusted configuration; align auth:<guard>, credential checks, the authenticated user, and authorization with the same identity domain.
• Pass an allowlisted array of validated scalar credentials to Auth::attempt() or attemptWhen(); add tenant and enabled-account conditions on the server. Do not hash the submitted password first or let request fields supply arbitrary credential predicates.
• Recheck disabled-account and tenant-membership restrictions on subsequent session, remember-cookie, and bearer-token requests; conditions supplied to attempt() are not automatically reapplied when an existing identity is restored.
• Restrict login(), loginUsingId(), onceUsingId(), and setUser() to flows that have already proved identity and satisfied required factors; these APIs do not verify a password. Direct attempt(), once(), Basic authentication, and custom token-issuance endpoints also do not execute Fortify's MFA pipeline.
• Give unknown accounts, incorrect passwords, and disabled accounts the same public failure shape. Attach login throttling explicitly to custom endpoints; Auth::attempt() is not a rate limiter. Combine canonical