Introduction.

Laravel Dev Login lets you switch between configured users during development without entering their credentials each time. Define a profile for each user and session guard you need, visit /dev-login, and click a button to authenticate:

// config/dev-login.php
'profiles' => [
    'admin' => [
        'label' => 'Admin',
        'email' => 'admin@example.com',
    ],
    'member' => [
        'label' => 'Member',
        'email' => 'member@example.com',
    ],
],

Each profile becomes a button. Clicking one logs in the matching user without checking a password.

The package supports Laravel 12 and 13 on PHP 8.3 and 8.4.

How a click becomes a session

Clicking a button posts to dev-login.attempt. The package then makes the profile's tenant current if it names one, asks a resolver for the user the profile points at, and hands that user to Laravel's session guard.

The last step is SessionGuard::login(), the same call Laravel's own login makes. The session regenerates, the remember cookie is written if the profile asked for one, and the Login event fires. Nothing about the session that results is special.

That is why the package never writes to your users table and never touches a password. It resolves a user that already exists and drives the guard you already have.

How access is restricted

A page that logs anybody in without a password has to be hard to reach by accident. Five checks decide whether it exists, and all five have to agree:

1. The enabled flag, off by default.
2. The environment allowlist, local and testing by default.
3. A production refusal that throws at boot rather than failing quietly.
4. No route registration at all when any of the above says no.
5. An allowed-hosts list checked against the host the request arrived on.

The first four read your application's own configuration. The fifth does not, which is what keeps the page shut when an .env file reaches a machine it should not have. Safety gates covers each one.

What it does not do

• No user creation. A profile that points at a user nobody seeded throws an exception naming the profile and the address. Seeding stays your job.
• No token or API guards. The package drives session guards only, and a profile naming any other guard fails with a message saying so.
• No impersonation. There is no switch-user feature for use from inside the application.
• No tenancy adapter. The package ships a TenantResolver contract and no implementation, because only your tenancy package knows how a tenant becomes current.
• No theming. Publishing the Blade views is the whole customization story. The page shows the current environment as a badge, and looking unlike your real login is deliberate.
• No login system. No passwords, registration, throttling, or 2FA.

What to read next

• Installation and setup to install the package and open the gates on your own machine.
• Quick start to configure a first profile and click it.
• Safety gates to understand what stops this reaching production.

For usage questions, start a GitHub discussion. For a reproducible defect, open an issue.