Sign up and onboarding
Email and password sign up, then a screen to pick a username before anything else.
A starter kit that pairs
and
, with
already built.
Clone it,
start building.
Clone the repository, start Postgres and Mailpit with Docker, run composer setup in api and pnpm install in web, then run composer dev to start the API, queue worker, log viewer and Next.js.
Authentication you don’t have to write.
Try the real flows. Every request the frontend makes shows up in the log.
Sign in
Everything around the login screen.
Email or username
Sign in with either one, with “keep me signed in” for longer sessions.
Verification on any device
Signed links that don’t need a session, so they open anywhere. They expire after an hour.
Password reset
The same response whether or not the account exists. A reset signs out every other session.
Live availability
Email and username checks while you type, including the reserved names you configure.
Account settings
Profile, email change with re-verification, username, password and account deletion.
Cookie sessions
Sanctum SPA auth with HTTP-only cookies and CSRF protection. No tokens stored in JavaScript.
Tests and CI
Pest and Vitest suites, linting and formatting, run by GitHub Actions on every push.
A stack you already know.
- API
- Laravel 13PHP 8.3+SanctumPostgreSQLPest
- Web
- Next.js 16App RouterReact 19TypeScript
- Data & forms
- TanStack Query v5React Hook FormZod 4
- UI
- Tailwind CSS 4shadcn/uiBase UISonnerlucide
- Tooling
- PintESLintPrettierVitestGitHub ActionsLaravel Boost
api/ Laravel API → localhost:8000 web/ Next.js app → localhost:3000 docker/ init scripts for the optional Docker services
Free and open source.
MIT licensed. Use it in as many projects as you like, and change whatever you want. Start from the template on GitHub or clone it.
Use this template$ git clone https://github.com/jordansmalls/prism.git my-appFrequently Asked Questions
Who is Prism for?
Developers who want a Laravel API and a Next.js frontend without spending the first week on authentication. Clone it, rename it, and start on your own features.
Why cookies instead of API tokens?
Prism uses Sanctum’s SPA authentication: an HTTP-only session cookie plus CSRF protection, so there’s no token for JavaScript to leak. The API client fetches /sanctum/csrf-cookie before the first request that changes data, and if it gets a 419 it refreshes the token and retries once.
Do the frontend and API need to share a domain?
No. The browser only talks to Next.js, which forwards /api/* and /sanctum/* to Laravel. Cookies belong to the frontend’s domain and there’s no CORS to configure, so you can run Vercel in front of Laravel Cloud.
To call the API directly instead, set NEXT_PUBLIC_API_URL in web, and SESSION_DOMAIN, FRONTEND_URL and SANCTUM_STATEFUL_DOMAINS in api.
Do I need Docker?
No. The included docker-compose.yml starts Postgres 17 and Mailpit, but any PostgreSQL 14+ works. Create the laravel_next and laravel_next_test databases and set your credentials in api/.env.
Where do emails go during development?
By default they’re written to api/storage/logs/laravel.log, so you can copy the link straight out. If you run Mailpit, point the MAIL_* settings at it and read them at localhost:8025.
How are routes protected?
An <AuthGuard> wraps each route group and handles every redirect for guests, onboarding and signed-in users. It only controls what the user sees: the API checks auth on every request, and the onboarded middleware covers routes that need a username.
How do I make it my own?
Set your app name in APP_NAME and NEXT_PUBLIC_APP_NAME, update siteConfig, rename the databases, and add your top-level routes to the reserved usernames. The README has the full checklist.