Uses React Router for browser routing instead of Inertia.js
LaravelViteReactStarter
laravel-react-spa-starter-kit — Laravel Starter Template
By muradyanvano
A community-maintained Laravel + React single-page application starter that replaces Inertia.js with React Router and integrates Fortify, Sanctum, and WebAuthn passkey authentication.
Explore the design
Compare the page layouts and mobile experience. Open any screenshot for a closer look.
Author preview
Author-provided preview
Preview provided in the project README.
One original preview is available. Open the full image to inspect the design.
Screenshots show visual appearance; interactive behavior may differ.
Recorded 2026-10-03View source
What stands out
A quick read of the recorded project description.
Laravel Fortify provides authentication endpoints, and Sanctum protects SPA sessions with stateful cookies + CSRF, without storing tokens in localStorage
Supports WebAuthn passkey login, password confirmation, and passkey management in security settings
Includes two-factor authentication and recovery codes (for the password login path)
TypeScript, Wayfinder typed routes, Tailwind CSS, and shadcn/ui
Testing and quality tools such as Pest, Vitest, PHPStan, and Pint
Template Details
This is a community-maintained Laravel starter for building a same-origin, traditional React single-page application. It does not use Inertia.js; instead, Laravel provides the API, Fortify authentication endpoints, Sanctum session authentication, and the Blade SPA shell, while React handles browser-side routing, layout pages, and API interaction. The stack includes Laravel, React, TypeScript, React Router, Fortify, Sanctum, Wayfinder, and Vite, with Axios as the HTTP client.
Features cover both authentication and application sides: the authentication side provides login, registration, logout, password reset, email verification, password confirmation, WebAuthn passkey login and password confirmation, two-factor authentication based on password login, and recovery codes; the application side provides a responsive sidebar shell with mobile navigation, a dashboard, profile settings (including password change and account deletion), security settings (password, two-factor authentication, passkey management), and light/dark/system appearance settings.
Boundaries to note: this project is not an official Laravel starter and is not endorsed by Laravel; passkeys depend on browser and platform WebAuthn support, and do not support conditional WebAuthn autofill, passkey "remember me," or custom credential syncing; passkey login completes the session directly without the two-factor authentication challenge used for password login; the default design is for same-origin deployment, and cross-origin deployment requires configuring SANCTUM_STATEFUL_DOMAINS, session cookie domain and SameSite, CORS, and CSRF yourself, which is outside the default kit's scope. Password reset and email verification depend on Laravel mail configuration, so MAIL_* or a local driver must be set first.
LaravelViteReactStarter
Is it right for your project?
Use Cases
- Same-origin SPA projects that want Laravel as the backend and React as the frontend without introducing Inertia.js
- Projects that need ready-to-use login, registration, password reset, email verification, and two-factor authentication flows
- Projects planning to offer WebAuthn passkey login and a passkey management interface in the application
- Projects that need a responsive sidebar shell, dashboard, profile, and security settings as basic page structure
Suitable For
- Development teams that accept a community-maintained, non-official Laravel starter
- Developers using PHP 8.3+, Composer, Node.js 22+, and SQLite or another supported database
- React developers who prefer TypeScript and the React Router routing model
- Projects that need same-origin cookie session authentication rather than JWT stored in the browser
Getting started & customization
Use these recorded setup notes alongside the repository instructions for your chosen version.
- 1
Environment requirements: PHP 8.3+, Composer, Node.js 22+ (recommended; CI also covers Node 25), with SQLite or another supported database by default.
- 2
You can create a project with laravel new my-app --using=muradyanvano/laravel-react-spa-starter-kit or composer create-project muradyanvano/laravel-react-spa-starter-kit my-app; specify a version number when a reproducible install is needed.
- 3
resources/js/actions, resources/js/routes, and resources/js/wayfinder are generated directories and are gitignored; do not edit or commit them. In a fresh directory, run composer setup or npm run build / npm run types:check first so that @/routes imports can be resolved.
- 4
Password reset and email verification depend on Laravel mail configuration; before use, set MAIL_* or a local driver such as log / Mailpit.
- 5
Cross-origin deployment requires configuring SANCTUM_STATEFUL_DOMAINS, session cookie domain and SameSite, CORS, and CSRF yourself; the default kit does not cover this scenario.
License & source material
Usage conditions & limitations
Free to use · keep license noticeThis listing covers the free version in the public repository under the MIT license; the free scope is the code for that version and does not mean external services or third-party assets are free.
Must comply with when using
- You may use, modify, commercialize, and distribute the code of this version for free.
- When distributing copies or substantial portions of the code, retain the original author's copyright notice and the full MIT license notice.
- The code is provided as is; warranties and limitations of liability are governed by the original license and applicable law.
Additional costs & items to verify
- This project is community-maintained and is not an official Laravel starter, nor is it recognized or endorsed by Laravel; do not promote it as an official project.
- Only same-origin deployment is supported by default; cross-origin deployment requires configuring SANCTUM_STATEFUL_DOMAINS, session cookie domain and SameSite, CORS, and CSRF yourself, and is outside the default kit's support scope.
- Password reset and email verification depend on Laravel mail services; before use beyond testing, you must configure MAIL_* or a local driver such as log/Mailpit, otherwise the related flows are unavailable.
- Passkeys depend on browser and platform WebAuthn support; unsupported browsers can only view and delete existing passkeys and cannot register new passkeys through the interface.
- This kit does not implement conditional WebAuthn autofill, passkey "remember me," or custom credential syncing.
- Passkey login completes the session directly without the two-factor authentication challenge used for password login, so two-factor authentication does not cover the passkey login path.
- resources/js/actions, resources/js/routes, and resources/js/wayfinder are generated directories and are gitignored; they should not be edited or committed. In a fresh directory, run composer setup or npm run build / npm run types:check first so that @/routes imports can be resolved.
- Laravel Boost is an optional development dependency and its installation is not required; related generated state is gitignored and is not distributed to users via Packagist.
- Demo images, fonts, icons, and other third-party assets must be checked against their respective licenses; the code's MIT license alone is not sufficient to judge them.
- External services such as domains, hosting, databases, payments, or AI may incur separate charges.
View Original Text Basis
Permission is hereby granted, free of charge
Original License Text
This is **not** an official Laravel starter kit and is not endorsed by Laravel.
Original README
Split-origin deployments need correct `SANCTUM_STATEFUL_DOMAINS`, session cookie domain/SameSite, CORS, and CSRF configuration. That layout is out of scope for the default kit.
Original README
Password reset and email verification use Laravel’s mailer. Configure `MAIL_*` (or a local driver such as log / Mailpit) before relying on those flows outside tests.
Original README
Passkeys depend on browser and platform WebAuthn support. Unsupported browsers can still view and delete existing passkeys, but cannot register new ones from the UI.
Original README
This kit does **not** implement conditional WebAuthn autofill, passkey “remember me”, or custom credential synchronization.
Original README
**Passkey login:** Native Fortify passkey authentication completes the session directly and does **not** route through the password-login two-factor challenge.
Original README
These directories are **generated** and gitignored:
Original README
https://github.com/muradyanvano/laravel-react-spa-starter-kit/blob/main/LICENSEhttps://github.com/muradyanvano/laravel-react-spa-starter-kit/blob/main/README.mdBoost setup is **not** mandatory.
Original README
Compiled by DeepSeek based on repository license and README ·2026-10-03. Results only cover the materials read; dependencies, images, fonts, and subsequent term changes are subject to their respective original texts.
Project checks & description sources
Template Information
- Source platforms
- GitHub
- Documentation and maintenance reference score
- More documented · 88 / 100
- Technologies
- Laravel · Vite · React
- Website type
- Starter
How this score is calculated
Our heuristic uses license records (up to 30), a demo link (12), a preview (10), stars (15), recorded maintenance (15), description completeness (8), feature records (5) and classification data (5). It is not a code, security or performance test, or a Google score. A link does not establish tested functionality.
What to verify for this project
- Repository update recorded
- 2026-09-17
- Screenshot last checked
- 2026-10-03
A demo link is listed. Check it with your own content and viewport sizes; its presence does not confirm that forms, authentication or payments work.
The catalog identifies Laravel as the primary stack. Check the actual dependency manifest and lockfile for versions and hosting requirements. These notes use recorded metadata, not a code audit or a deployment test.
Use a selection guide →How this description was prepared
AI-assisted description based on catalog records and repository material. Repository authors are not automatically the reviewers of this description.
Review declaration: [email protected] · 2026-10-04
Inspect the recorded source material
SHA-256: 80b031ec93881af3a3753297e888499c7691ecdf0bbd00d980734f53a654eaf6
2026-10-03T15:22:24.080Z
Source file / repository# Laravel React SPA Starter Kit
A community Laravel starter kit for a first-party React SPA using React Router instead of Inertia.js.
[](https://github.com/muradyanvano/laravel-react-spa-starter-kit/actions/workflows/tests.yml)
[](https://packagist.org/packages/muradyanvano/laravel-react-spa-starter-kit)
[](https://packagist.org/packages/muradyanvano/laravel-react-spa-starter-kit)
[](https://packagist.org/packages/muradyanvano/laravel-react-spa-starter-kit)
[](https://laravel.com)
[](LICENSE)
<p align="center">
<img
src=".github/assets/social-preview.png"
alt="Laravel React SPA Starter Kit"
width="100%"
>
</p>
This is **not** an official Laravel starter kit and is not endorsed by Laravel.
## Why this starter kit
Stack: **Laravel**, **React**, **TypeScript**, **React Router**, **Fortify**, **Sanctum**, **Wayfinder**, and **Vite**.
Architecture choice: a traditional same-origin SPA instead of Inertia.js.
```text
Laravel (API / Fortify / Sanctum)
→ Blade SPA shell
→ React + React Router
→ Axios
```
UI and developer experience are inspired by Laravel’s official React starter kit; the runtime is a conventional SPA with browser-owned routing.
## Quick Start
### Laravel Installer
```bash
laravel new my-app --using=muradyanvano/laravel-react-spa-starter-kit
cd my-app
npm run dev
```
### Composer create-project
Install the latest stable release from Packagist:
```bash
composer create-project muradyanvano/laravel-react-spa-starter-kit my-app
cd my-app
npm run dev
```
Pin a specific version when you need a reproducible install:
```bash
composer create-project muradyanvano/laravel-react-spa-starter-kit my-app v1.1.0
```
### Requirements
- PHP 8.3+
- Composer
- Node.js 22+ (recommended; CI also covers Node 25)
- SQLite (default) or another supported database
The generated project is a normal Laravel application you own and can customize freely.
## Features
### Authentication
- Login / registration / logout
- Password reset
- Email verification
- Password confirmation
- **Passkey sign-in** (WebAuthn)
- **Passkey password confirmation**
- Two-factor authentication (password login)
- Recovery codes
### Application
- Responsive sidebar shell and mobile navigation
- Dashboard
- Profile settings (including password change and account deletion)
- Security settings (password, 2FA, **passkey management**)
- Appearance settings (light / dark / system)
### Passkeys
Passkeys provide passwordless sign-in through your browser or platform authenticator (Touch ID, Windows Hello, security keys, and similar).
**Sign in:** On the login page, use **Sign in with a passkey** when your browser supports WebAuthn. Password login remains available as a fallback.
**Confirm sensitive actions:** On the confirm-password page, you can confirm with a passkey instead of re-entering your password when supported.
**Manage passkeys:** In **Settings → Security**, you can:
- view registered passkeys (name, authenticator label, created/last-used metadata)
- add/register a new passkey
- delete a passkey (with confirmation)
Adding or deleting passkeys requires recent password or passkey confirmation when Fortify password confirmation is enabled.
Passkeys depend on browser and platform WebAuthn support. Unsupported browsers can still view and delete existing passkeys, but cannot register new ones from the UI.
This kit does **not** implement conditional WebAuthn autofill, passkey “remember me”, or custom credential synchronization.
### Developer experience
- TypeScript
- Laravel Wayfinder
- Axios
- Tailwind CSS + shadcn/ui
- Pest, Vitest, PHPStan, Pint
- Optional Laravel Boost support
## Architecture
| Concern | This kit |
| ---------------------- | ------------------------------- |
| Browser routing | React Router |
| Auth capabilities | Laravel Fortify |
| SPA session auth | Sanctum stateful cookies + CSRF |
| HTTP client | Axios |
| WebAuthn ceremonies | `@laravel/passkeys` |
| Typed routes / actions | Laravel Wayfinder |
| Page shell | Blade SPA shell + React |
| Inertia | Not used |
**Laravel** owns the API/backend, Fortify endpoints, Sanctum session authentication, and the SPA shell/fallback.
**React** owns browser routing, layouts/pages, authentication state, and API interaction.
Laravel serves the Blade SPA shell for browser routes such as `/dashboard` and `/settings/profile`. The catch-all does **not** swallow `/api/*`, `/sanctum/*`, `/up`, `/email/*`, `/storage/*`, Fortify endpoints, or public assets.
## Authentication and security
Default design: Laravel and the SPA share one origin (for example `https://example.com`).
- Sanctum cookie / session authentication (not JWT or bearer tokens in browser storage)
- CSRF protection via `/sanctum/csrf-cookie` and `X-XSRF-TOKEN`
- No auth tokens stored in `localStorage`
- Session regeneration on authentication events
- Password confirmation for sensitive actions (including passkey registration and deletion when configured)
- Email verification
- Two-factor authentication and recovery-code handling for **password login**
- WebAuthn passkeys through Laravel Fortify and `laravel/passkeys`
**Password login and 2FA:** When two-factor authentication is enabled, password login continues through Fortify’s normal TOTP/recovery-code challenge.
**Passkey login:** Native Fortify passkey authentication completes the session directly and does **not** route through the password-login two-factor challenge.
**Passkey metadata:** The settings passkey list API returns display metadata only (name, authenticator label, human-readable timestamps). Credential material is never exposed to the frontend.
Split-origin deployments need correct `SANCTUM_STATEFUL_DOMAINS`, session cookie domain/SameSite, CORS, and CSRF configuration. That layout is out of scope for the default kit.
Useful variables: `APP_URL`, `SESSION_DOMAIN`, `SESSION_SECURE_COOKIE`, `SANCTUM_STATEFUL_DOMAINS`, `MAIL_*`.
Password reset and email verification use Laravel’s mailer. Configure `MAIL_*` (or a local driver such as log / Mailpit) before relying on those flows outside tests.
## Appearance
Appearance is client-driven (light / dark / system) via `localStorage` and an `appearance` cookie, matching the official-kit style settings experience.
## Development
From a generated app or a clone of this repository:
```bash
composer setup # install deps, .env, key, migrate, build
composer dev # concurrent PHP + Vite + queue/logs helpers
composer test # Pint + PHPStan + Pest
composer ci:check # frontend gates + backend suite
```
Frontend:
```bash
npm run dev
npm run build
npm run test
npm run check
npm run types:check
```
Or run `php artisan serve` and `npm run dev` in separate terminals.
### Working on this repository
```bash
git clone https://github.com/muradyanvano/laravel-react-spa-starter-kit.git
cd laravel-react-spa-starter-kit
composer setup
```
## Testing and quality
CI runs on pushes and pull requests against `main`, including:
- Pest (PHP)
- Vitest (React)
- PHPStan
- TypeScript (`types:check`)
- ESLint / formatting (`check`)
- Laravel Pint
- Production build verification
- Fresh git-archive consumer install checks
- Node.js **22** and **25** matrix coverage
Exact test counts belong in release notes; they change over time.
## Wayfinder
These directories are **generated** and gitignored:
- `resources/js/actions`
- `resources/js/routes`
- `resources/js/wayfinder`
Do not edit or commit them. `npm run build` / `npm run dev` generate them via `@laravel/vite-plugin-wayfinder`. `npm run types:check` also ensures they exist before TypeScript runs.
On a completely fresh tree, run `composer setup` (or at least `npm run build` / `npm run types:check`) before expecting TypeScript imports from `@/routes` to resolve.
## Laravel Boost
[`laravel/boost`](https://github.com/laravel/boost) is an optional development dependency for AI-assisted coding.
Boost setup is **not** mandatory. After creating an app, install Boost guidelines/skills only if you want them:
```bash
php artisan boost:install
```
The Laravel installer may also offer Boost during `laravel new`. Generated Boost state (`boost.json`, agent guideline files such as `AGENTS.md`) is gitignored and is **not** shipped to Packagist consumers.
## Attribution
UI and developer experience inspired by Laravel’s official [React starter kit](https://github.com/laravel/react-starter-kit), including passkey UI patterns.
This community project is independent of Laravel and is **not** an official starter kit maintained by Laravel. See [`NOTICE.md`](NOTICE.md) for third-party notices.
## Links
- [GitHub repository](https://github.com/muradyanvano/laravel-react-spa-starter-kit)
- [Packagist package](https://packagist.org/packages/muradyanvano/laravel-react-spa-starter-kit)
- [Contributing](CONTRIBUTING.md)
- [Security policy](SECURITY.md)
- [License](LICENSE)
- [Notice](NOTICE.md)
- [Laravel documentation](https://laravel.com/docs)
- [React documentation](https://react.dev)
- [React Router documentation](https://reactrouter.com)
## License
MIT — see [`LICENSE`](LICENSE) and [`NOTICE.md`](NOTICE.md).
Explore similar templates
Compare previews and descriptions within the same stack and category.
sage
Sage is a WordPress starter theme maintained by Roots, using Laravel Blade components and templates, Vite builds, Tailwind CSS, and built-in block editor support.
Laravel · Starter
wave
Wave is an open-source SaaS starter kit built on Laravel and released under the MIT license.
Laravel · SaaS
filament-starter
A Laravel TALL stack starter template maintained by Log1x, with a preconfigured Filament admin panel and plugins including Curator, Gravatar, Exceptions, Jobs Monitor, Breezy, Peek, and Logger.
Laravel · Starter
electrik
Electrik is a Laravel SaaS starter kit installed as a Composer package, with authentication, teams, Stripe subscription billing, and the Slate 3 interface under the Electrik\ namespace rather than copied into App\.
Laravel · SaaS
php-saas
php-saas is a Laravel-based SaaS starter positioned as an everything-included kit. It generates new projects via a global Composer command and includes authentication with two-factor, API tokens, Stripe and Paddle billing, and project, team, and organization management.
Laravel · SaaS
filament-jetstream
A Laravel starter kit that implements Jetstream-like authentication and account features using Filament's native panels and components. It includes login, registration, two-factor authentication, session management, user profiles, and optional teams and API tokens.
Laravel · Starter