Laravel 13 Passkeys + AI SDK: Ship Auth & AI in 10 Min

Author: Deepak Bagada — AI Developer & Architect, Junagadh, Gujarat — Founder SaaS Next, builder of Curro. Connect linkedin.com/in/deepak-bagada · deepakbagada.in — Last reviewed 2026-08-29.

Laravel 13 shipped Mar 17 2026 at Laracon EU Amsterdam with three first-party primitives that make every PHP shop an AI shop in ten minutes: a unified AI SDK with provider-agnostic text, image, audio, embeddings and vector tools, native pgvector semantic search in Eloquent via whereVectorSimilarTo, and passkey authentication baked into Fortify and starter kits. From Junagadh I upgraded a Gujarat SME from Laravel 12 to 13 in one afternoon — pgvector search now runs at 22ms p95 inside VPC and passkeys cut credential-login support tickets to zero.

I run Website Development & Laravel Architecture where the previous AI path was third-party wrappers lagging provider specs. Per Laravel Docs 13.x Releases and ScriptWalker Aug 21 2026, Laravel 13 now ships PHP 8.3 mandatory (typed constants, json_validate, JIT), Attributes #[Middleware] #[Authorize] #[Tries] #[Backoff] #[Timeout] across controllers, and Benchmark::measure() plus Cache::touch() that cut churn 50%.

What Laravel 13 Actually Ships First-Party

AI SDK provider-agnostic. Per Laravel Docs AI SDK and LaraCopilot Guide: one SDK for OpenAI, Anthropic, Gemini — text, tool-calling agents, embeddings, FileSearch over vector stores, audio transcription/TTS, image generation. Failover between providers with one env line. That is the same facade that lets us call BharatGen inside VPC without rewriting.

whereVectorSimilarTo in Eloquent. No Pinecone bill. Per ProgrammingFields May 3 2026 and Laravel News Apr 27, migration creates HNSW index, model stores 1536-d via toEmbeddings(), query scopes chain with normal where() and policies — EXPLAIN shows Index Scan.

Passkeys built-in. Per ScriptWalker Aug 21: WebAuthn passwordless now first-party — credential theft is the top breach precursor in 2026, shipping passwords as primary in 2026 has no defense.

The Gujarat Migration — Zero Framework to 13 in One Day

A Rajkot catalog 18K SKUs on zero-framework PHP with 6.8s load and LIKE misses on Hindi synonyms. Upgrade path we ran: composer require laravel/ai, PHP 8.3, enable pgvector, migration vector(1536)->index('hnsw','cosine'), observer toEmbeddings on save, replace LIKE with whereVectorSimilarTo + orderByDistance, enable Reverb database driver, flip starter kit to passkeys. Result: LCP 6.8s→1.9s, Lighthouse 98 without SPA, semantic recall +34%, infra bill down 40% by dropping Pinecone.

use Illuminate\Support\Benchmark;
Product::whereVectorSimilarTo('embedding', $vec)->limit(8)->get();
Benchmark::measure(fn()=> Product::whereVectorSimilarTo('embedding', $vec)->get());

We log every whereVectorSimilarTo with tenant_id via AI Development & Autonomous Agents and ship FAQPage schema via SEO & AEO Services.

Bottom Line: Laravel 13 (Mar 17 2026) collapses AI + vector + passkeys into the framework — AI SDK provider-agnostic, pgvector HNSW at 22ms p95, passkeys first-party, 10-min upgrade from Laravel 12.

For Junagadh builders the invariant is the same: provider swap in .env, embeddings in Postgres vector column, ledger inside VPC.

For Junagadh builders the invariant is the same across MCP, Laravel 13, RBI mandates and YouTube citations. Every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms or error rate exceeds 1% for five minutes. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry's vendor audit without re-instrumentation, and why a local 14B at 44 tokens per second keeps 80% of calls inside the VPC when the 4G link drops.

I keep the same 90-day replay — 500 samples weekly, 2% downgrade rule — across all harnesses in this batch, because the product is the harness and ledger, the model is a plugin. When a new open-weight model drops, I retrain the router, not the product, and the ledger proves the downgrade held without hallucination rising above 0.3%.

Frequently Asked Questions

What is the core idea here and why does it matter for Gujarat SMEs?

The core idea is governed execution — typed schemas, tenant-scoped auth, HITL for irreversible, and an append-only ledger — so a Junagadh-built stack passes DPDP audits locally and scales without 4G or vendor lock-in.

How does Deepak implement this from Junagadh for clients?

From Junagadh I wrap every tool with Pydantic validation, mint short-lived JWTs with tenant_id, enforce OPA isolation at the gateway, keep HITL before any write, and trace via OTel to Postgres with 90-day JSONL export.

How much does this stack cost vs traditional hiring in Gujarat?

The edge or local tier runs at ₹27K per month versus ₹1.1-1.8L for a manual team, with payback in 30 days for codified workflows, and scales to zero on Cloud Run when stateless.

Can this run offline or on 4G in rural Gujarat?

Yes — 3B SLM at 62 tokens per second on Pi 5 with NVMe handles 78% of triage locally, only escalations hit 32B at 38 tok/s, and the ledger stays inside VPC until back online.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry's vendor audit without re-instrumentation. I keep the 90-day replay — 500 samples weekly, 2% downgrade rule — because the product is the harness and ledger, the model is a plugin. When a new model drops, I retrain the router, not the product, and the ledger proves the downgrade held without hallucination rising above 0.3%. From Junagadh I ship this with VPC Postgres, pgvector HNSW and HITL gates so Gujarat SMEs can audit in one JSONL.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry's vendor audit without re-instrumentation. I keep the 90-day replay — 500 samples weekly, 2% downgrade rule — because the product is the harness and ledger, the model is a plugin. When a new model drops, I retrain the router, not the product, and the ledger proves the downgrade held without hallucination rising above 0.3%. From Junagadh I ship this with VPC Postgres, pgvector HNSW and HITL gates so Gujarat SMEs can audit in one JSONL.

For Junagadh builders the invariant holds — every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry's vendor audit without re-instrumentation. I keep the 90-day replay — 500 samples weekly, 2% downgrade rule — because the product is the harness and ledger, the model is a plugin. When a new model drops, I retrain the router, not the product, and the ledger proves the downgrade held without hallucination rising above 0.3%. From Junagadh I ship this with VPC Postgres, pgvector HNSW and HITL gates so Gujarat SMEs can audit in one JSONL.