AuthEvent events

18 FeatherPanel plugin events on AuthEvent (18 emitted by the core): the event names, the arguments each listener gets, where they fire and a PHP listener for each.

Last synced from FeatherPanel 15b94e9 on 23 Oct 2026.

On this page

Part of the plugin events reference. Listeners get the payload values as positional arguments in the order shown, cannot cancel the action, and must catch their own exceptions.

Setup

Import AuthEvent in your entry class and register listeners in processEvents():

<?php

namespace App\Addons\myplugin;

use App\App;
use App\Plugins\AppPlugin;
use App\Plugins\PluginEvents;
use App\Plugins\Events\Events\AuthEvent;

class MyPlugin implements AppPlugin
{
    public static function processEvents(PluginEvents $event): void
    {
        $event->on(AuthEvent::onAuthEmailLoginCodeRequested(), function ($user, $ipAddress): void {
            App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:email:login:code:requested ' . json_encode(['user' => $user, 'ip_address' => $ipAddress]));
        });
    }

    public static function pluginInstall(): void
    {
    }

    public static function pluginUninstall(): void
    {
    }
}

`AuthEvent::onAuth2FAEnabled()`

Name: featherpanel:auth:2fa:enabledemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info.

#	Payload key	Listener parameter	Type
1	`user`	`$user`	`array`from docblock

When it fires (1 site)

TwoFactorController::putPUT /api/user/auth/two-factor

$event->on(AuthEvent::onAuth2FAEnabled(), function ($user): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:2fa:enabled ' . json_encode(['user' => $user]));
});

`AuthEvent::onAuth2FAFailed()`

Name: featherpanel:auth:2fa:failedemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info. (the emitter passes 2 values, see the table)

#	Payload key	Listener parameter	Type
1	`user`	`$user`	not declared
2	`ip_address`	`$ipAddress`	not declared

When it fires (1 site)

TwoFactorController::postPOST /api/user/auth/two-factor

$event->on(AuthEvent::onAuth2FAFailed(), function ($user, $ipAddress): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:2fa:failed');
});

`AuthEvent::onAuth2FASetup()`

Name: featherpanel:auth:2fa:setupemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info.

#	Payload key	Listener parameter	Type
1	`user`	`$user`	`array`from docblock

When it fires (1 site)

TwoFactorController::getGET /api/user/auth/two-factor

$event->on(AuthEvent::onAuth2FASetup(), function ($user): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:2fa:setup ' . json_encode(['user' => $user]));
});

`AuthEvent::onAuth2FAVerified()`

Name: featherpanel:auth:2fa:verifiedemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info.

#	Payload key	Listener parameter	Type
1	`user`	`$user`	`array`from docblock

When it fires (1 site)

TwoFactorController::postPOST /api/user/auth/two-factor

$event->on(AuthEvent::onAuth2FAVerified(), function ($user): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:2fa:verified ' . json_encode(['user' => $user]));
});

`AuthEvent::onAuthAccountLocked()`

Name: featherpanel:auth:account:lockedemitted at 6 sites2 payload shapesCancel or modify: nodefinition

Docblock: array user info. (the emitter passes 3 values, see the table)

#	Payload key	Listener parameter	Type
1	`identifier`	`$identifier`	`string`
2	`lockout_seconds`	`$lockoutSeconds`	`int\|null`
3	`attempts`	`$attempts`not at every site	`int`

Arguments passed	Emitted from
`identifier`, `lockout_seconds`, `attempts`	`AccountLockoutHelper::reserveHardLockAttempt` `AccountLockoutHelper::recordFailure` `AccountLockoutHelper::recordFailure` `AccountLockoutHelper::reserveHardLockAttemptViaFileStore`
`identifier`, `lockout_seconds`, `already_locked`	`AccountLockoutHelper::reserveHardLockAttempt` `AccountLockoutHelper::reserveHardLockAttemptViaFileStore`

When it fires (6 sites)

AccountLockoutHelper::reserveHardLockAttempt via emitAuthEvent()
AccountLockoutHelper::reserveHardLockAttempt via emitAuthEvent()
AccountLockoutHelper::recordFailure via emitAuthEvent()
AccountLockoutHelper::recordFailure via emitAuthEvent()
AccountLockoutHelper::reserveHardLockAttemptViaFileStore via emitAuthEvent()
AccountLockoutHelper::reserveHardLockAttemptViaFileStore via emitAuthEvent()

$event->on(AuthEvent::onAuthAccountLocked(), function ($identifier, $lockoutSeconds, ...$rest): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:account:locked ' . json_encode(['identifier' => $identifier, 'lockout_seconds' => $lockoutSeconds]));
});

`AuthEvent::onAuthAccountUnlocked()`

Name: featherpanel:auth:account:unlockedemitted at 2 sitesCancel or modify: nodefinition

Docblock: array user info.

#	Payload key	Listener parameter	Type
1	`identifier`	`$identifier`	`string`

When it fires (2 sites)

AccountLockoutHelper::clear via emitAuthEvent()
AccountLockoutHelper::clear via emitAuthEvent()

$event->on(AuthEvent::onAuthAccountUnlocked(), function ($identifier): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:account:unlocked ' . json_encode(['identifier' => $identifier]));
});

`AuthEvent::onAuthEmailChanged()`

Name: featherpanel:auth:email:changedemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info, string email. (the emitter passes 4 values, see the table)

#	Payload key	Listener parameter	Type
1	`user_uuid`	`$userUuid`	not declared
2	`old_email`	`$oldEmail`	not declared
3	`new_email`	`$newEmail`	not declared
4	`ip_address`	`$ipAddress`	not declared

When it fires (1 site)

SessionController::putPATCH /api/user/session

$event->on(AuthEvent::onAuthEmailChanged(), function ($userUuid, $oldEmail, $newEmail, $ipAddress): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:email:changed');
});

`AuthEvent::onAuthEmailLoginCodeRequested()`

Name: featherpanel:auth:email:login:code:requestedemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info, string ip_address.

#	Payload key	Listener parameter	Type
1	`user`	`$user`	`array`from docblock
2	`ip_address`	`$ipAddress`	`string`from docblock

When it fires (1 site)

EmailLoginController::requestCodePOST /api/user/auth/email-login/request

$event->on(AuthEvent::onAuthEmailLoginCodeRequested(), function ($user, $ipAddress): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:email:login:code:requested ' . json_encode(['user' => $user, 'ip_address' => $ipAddress]));
});

`AuthEvent::onAuthForgotPassword()`

Name: featherpanel:auth:forgot:passwordemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info, string reset_url, string reset_token. (the emitter passes 4 values, see the table)

#	Payload key	Listener parameter	Type
1	`user`	`$user`	not declared
2	`reset_url`	`$resetUrl`	not declared
3	`ip_address`	`$ipAddress`	not declared
4	`reset_token`	`$resetToken`	not declared

When it fires (1 site)

ForgotPasswordController::putPUT /api/user/auth/forgot-password

$event->on(AuthEvent::onAuthForgotPassword(), function ($user, $resetUrl, $ipAddress, $resetToken): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:forgot:password');
});

`AuthEvent::onAuthForgotPasswordFailed()`

Name: featherpanel:auth:forgot:password:failedemitted at 1 siteCancel or modify: nodefinition

Docblock: string email, string reason. (the emitter passes 3 values, see the table)

#	Payload key	Listener parameter	Type
1	`email`	`$email`	not declared
2	`reason`	`$reason`	`string`
3	`ip_address`	`$ipAddress`	not declared

When it fires (1 site)

ForgotPasswordController::putPUT /api/user/auth/forgot-password

$event->on(AuthEvent::onAuthForgotPasswordFailed(), function ($email, $reason, $ipAddress): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:forgot:password:failed ' . json_encode(['reason' => $reason]));
});

`AuthEvent::onAuthLoginFailed()`

Name: featherpanel:auth:login:failedemitted at 8 sites4 payload shapesCancel or modify: nodefinition

Docblock: positional values from the emitted payload in key insertion order (see PluginEvents::emit). Possible keys across emitters: email, error, ip_address, provider, reason, user, username, username_or_email. (the emitter passes 3 values, see the table)

#	Payload key	Listener parameter	Type
1	`user`	`$user`not at every site	not declared
2	`reason`	`$reason`not at every site	`string`
3	`ip_address`	`$ipAddress`not at every site	not declared

Arguments passed	Emitted from
`user`, `reason`, `ip_address`	`EmailLoginController::requestCode` `EmailLoginController::verifyCode` `LdapController::login` `LoginController::put` `LoginController::put`
`email`, `reason`, `ip_address`	`EmailLoginController::requestCode`
`username`, `provider`, `reason`, `error`, `ip_address`	`LdapController::login`
`username_or_email`, `reason`, `ip_address`	`LoginController::put`

When it fires (8 sites)

$event->on(AuthEvent::onAuthLoginFailed(), function (...$rest): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:login:failed');
});

`AuthEvent::onAuthLoginSuccess()`

Name: featherpanel:auth:login:successemitted at 3 sitesCancel or modify: nodefinition

Docblock: array user info.

#	Payload key	Listener parameter	Type
1	`user`	`$user`	`array`

When it fires (3 sites)

$event->on(AuthEvent::onAuthLoginSuccess(), function ($user): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:login:success ' . json_encode(['user' => $user]));
});

`AuthEvent::onAuthLogout()`

Name: featherpanel:auth:logoutemitted at 2 sitesCancel or modify: nodefinition

Docblock: array user info.

Emitted without a payload; the listener takes no arguments.

When it fires (2 sites)

$event->on(AuthEvent::onAuthLogout(), function (): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:logout');
});

`AuthEvent::onAuthPasswordChanged()`

Name: featherpanel:auth:password:changedemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info. (the emitter passes 3 values, see the table)

#	Payload key	Listener parameter	Type
1	`user_uuid`	`$userUuid`	not declared
2	`user`	`$user`	not declared
3	`ip_address`	`$ipAddress`	not declared

When it fires (1 site)

SessionController::putPATCH /api/user/session

$event->on(AuthEvent::onAuthPasswordChanged(), function ($userUuid, $user, $ipAddress): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:password:changed');
});

`AuthEvent::onAuthPasswordResetFailed()`

Name: featherpanel:auth:password:reset:failedemitted at 2 sitesCancel or modify: nodefinition

Docblock: string email, string reason. (the emitter passes 3 values, see the table)

#	Payload key	Listener parameter	Type
1	`token`	`$token`	not declared
2	`reason`	`$reason`	`string`
3	`ip_address`	`$ipAddress`	not declared

When it fires (2 sites)

$event->on(AuthEvent::onAuthPasswordResetFailed(), function ($token, $reason, $ipAddress): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:password:reset:failed ' . json_encode(['reason' => $reason]));
});

`AuthEvent::onAuthRegisterSuccess()`

Name: featherpanel:auth:register:successemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info.

#	Payload key	Listener parameter	Type
1	`user`	`$user`	`array`from docblock

When it fires (1 site)

RegisterController::putPUT /api/user/auth/register

$event->on(AuthEvent::onAuthRegisterSuccess(), function ($user): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:register:success ' . json_encode(['user' => $user]));
});

`AuthEvent::onAuthRegistrationFailed()`

Name: featherpanel:auth:registration:failedemitted at 7 sites2 payload shapesCancel or modify: nodefinition

Docblock: string email, string reason. (the emitter passes 4 values, see the table)

#	Payload key	Listener parameter	Type
1	`email`	`$email`	not declared
2	`username`	`$username`	not declared
3	`reason`	`$reason`	`string`
4	`ip_address`	`$ipAddress`	not declared

Arguments passed	Emitted from
`email`, `username`, `reason`, `ip_address`	`RegisterController::put` `RegisterController::put` `RegisterController::put` `RegisterController::put` `RegisterController::put` `RegisterController::put`
`email`, `username`, `reason`, `ip_address`, `abuse_confidence_score`	`RegisterController::put`

When it fires (7 sites)

$event->on(AuthEvent::onAuthRegistrationFailed(), function ($email, $username, $reason, $ipAddress, ...$rest): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:registration:failed ' . json_encode(['reason' => $reason]));
});

`AuthEvent::onAuthResetPasswordSuccess()`

Name: featherpanel:auth:reset:password:successemitted at 1 siteCancel or modify: nodefinition

Docblock: array user info.

#	Payload key	Listener parameter	Type
1	`user`	`$user`	`array`from docblock

When it fires (1 site)

ResetPasswordController::putPUT /api/user/auth/reset-password

$event->on(AuthEvent::onAuthResetPasswordSuccess(), function ($user): void {
    App::getInstance(true)->getLogger()->info('[myplugin] featherpanel:auth:reset:password:success ' . json_encode(['user' => $user]));
});