Multiple guards

By default everything runs through the configured guard. To let a request sign in to another guard — say an admin guard alongside web — list it in guards and submit a guard field from your sign-in form:

'guard' => 'web',
'guards' => ['admin'],

<input type="hidden" name="guard" value="admin">

The request issues the token for the selected guard, the user is resolved through that guard's user provider, and login completes on it. A guard not on the allowlist falls back silently to the default, so guards stay un-enumerable.

The security rule

Only list guards whose user provider you are happy to expose to self-service magic-link login. A user found in a guard's provider can sign in to that guard, so guards that share a provider also share access.

When the Fortify two-factor handoff is active, the selected guard should match fortify.guard — Fortify re-resolves the challenged user from its own guard's provider, and mismatched providers make the challenge fail closed.

Minting for a specific guard

The Mint API takes the guard as its second argument:

$link = $issuer->issueLink($user, 'admin');

The guard must be the default or one of the allowlisted guards, and the user must resolve through that guard's provider — otherwise you get an UnknownGuardException or a UserNotInGuardException rather than a credential that could never be consumed.