Account settings

Account settings let the signed-in user manage profile fields, password, Fortify two-factor authentication / passkeys, and admin UI locale. Routes live under /settings/* with session auth. Project branding and content locales are not here — see Project settings.

Layout & routes

Project / branding routes (/settings/project, /settings/appearance) require can-manage-project-settings — documented under Project settings.

Profile

Edit / update

edit renders Inertia settings/profile with props mustVerifyEmail and status.

update uses ProfileUpdateRequest / ProfileValidationRules:

If the email changes, email_verified_at is set to null.

Delete account

destroy uses ProfileDeleteRequest (password must be current_password), then logs out, soft-deletes the user, invalidates the session, and redirects to /.

Admin UI locale

This changes the shell language (en/it/de from config/i18n.php). It does not change project content locales.

Password, 2FA & passkeys (Fortify)

Password

PasswordUpdateRequest: current_password, password + confirmed + Password::default(). Throttled at 6/minute.

Two-factor authentication

Configured in config/fortify.php:

Features::twoFactorAuthentication([
    'confirm' => true,
    'confirmPassword' => true,
]);

SecurityController implements HasMiddleware: when Fortify 2FA or passkeys have confirmPassword enabled, password.confirm applies to edit only.

The security page surfaces Fortify 2FA props when the feature is on; enable/disable flows use Fortify’s two-factor routes (@/routes/two-factor). User model trait: TwoFactorAuthenticatable.

Passkeys

Full guide: Passkeys (secure context / HTTP vs HTTPS, register, sign-in, confirm password with passkey, two_factor_required, APP_URL / RP, Herd TLS, migration).

Configured in config/fortify.php:

Features::passkeys([
    'confirmPassword' => true,
]);

Plus the passkeys config block (relying_party_id, allowed_origins, user_handle_secret, timeout) derived from APP_URL / APP_KEY. User implements PasskeyUser and uses PasskeyAuthenticatable (alongside TwoFactorAuthenticatable).

Register / manage on Settings → Security: confirm password or Confirm with passkey (when enrolled and confirmPassword is on) → name the device → Add passkey → platform authenticator prompt → list shows name / created / last used; Delete removes that credential only for the signed-in user (@laravel/passkeys + Fortify passkey.* routes).

Sign in on auth/login via Sign in with passkey (usePasskeyVerify) — passwordless, no TOTP challenge after a successful assertion. PasskeyLoginResponse redirects with the same HomePath resolver as password login. Email + password remains available; if the user has confirmed TOTP, the Fortify challenge still applies on that path.

Confirm password (sensitive actions / password.confirm): password form is always available; Confirm with passkey only when enrolled + feature on + secure context — full behavior, abort, and HTTP fallback: Confirm password with a passkey.

MFA: project two_factor_required is satisfied by confirmed TOTP or ≥1 passkey. When the setting is on and the user has neither, /settings/security shows banner twoFactorEnforcedForUser — see Project settings and the decision table.

Personal theme (light / dark)

Light/dark preference is client-driven via localStorage and the appearance cookie. HandleAppearance applies it on subsequent requests. UI: AppearanceTabs / useAppearance (typically in the user menu).

This is not the Settings → Appearance page (that is project branding and requires can-manage-project-settings).

High contrast / reduce motion live in the same user menu under Accessibility — see Accessibility.

Email verification

Source map