Installation and setup.

Laravel Dev Login requires Laravel 12 or 13 on PHP 8.3 or 8.4. Install it as a development dependency:

composer require --dev byrcsc/laravel-dev-login

Laravel discovers DevLoginServiceProvider automatically. Nothing is exposed yet: the package ships disabled, so installing it changes no behaviour.

--dev is layer zero, not protection. Every safety gate is written on the assumption that a pipeline might ship dev dependencies anyway. Install it this way because it is correct, then rely on the gates.

1. Publish the configuration

php artisan vendor:publish --tag=dev-login-config

This writes config/dev-login.php with nine keys, all at their shipped defaults. Configuration lists every one.

2. Turn it on

Add the flag to your own .env, not to .env.example and not to anything that gets deployed:

DEV_LOGIN_ENABLED=true

This is the only environment variable the package reads. Everything else lives in the config file.

3. Check the host you develop on

allowed_hosts defaults to localhost, 127.0.0.1, and *.test. The check runs against the host the request actually arrived on, so a hostname outside that list gets a 404 even with everything else switched on.

Herd and Valet sites ending in .test are already covered. If you develop on something else, add it:

'allowed_hosts' => ['localhost', '127.0.0.1', '*.test', 'app.ddev.site'],

Entries are either an exact host or a leading-wildcard pattern such as *.test, which matches subdomains only. A bare * matches nothing, and an empty list allows nothing.

4. Confirm the routes exist

php artisan route:list --name=dev-login

  GET|HEAD   dev-login dev-login.show › ByRcsc\LaravelDevLogin\Http\Controlle…
  POST       dev-login/{profile} dev-login.attempt › ByRcsc\LaravelDevLogin\H…

                                                            Showing [2] routes

Both routes appear only when the enable flag, the environment allowlist, and the production check all agree. An empty result means a gate said no, and Safety gates explains which.

At this point /dev-login renders and says that no profiles are configured.

Environment reference

After changing configuration

The gates are read while the application boots, and route registration is decided there. Restart whatever serves the application after editing config/dev-login.php or .env.

If the application caches its config, rebuild it:

php artisan config:cache

The shipped config file survives caching. It contains no closures anywhere, which is why every seam in it is a class-string rather than a callback.

Verify the gates from the command line

Gatekeeper answers whether the package may operate right now:

php artisan tinker

app(ByRcsc\LaravelDevLogin\Gatekeeper::class)->passes();        // true
app(ByRcsc\LaravelDevLogin\Gatekeeper::class)->hostIsAllowed('localhost');

passes() covers the three boot-time gates. hostIsAllowed() answers the per-request one for a host you name.

What to read next

• Quick start to add a profile and click it.
• Configuration for every key in the published file.
• Safety gates to see what each gate refuses and how.