Voyti
User management, authentication & authorization
Overview
войти/vɐjˈtʲi/verb"to enter" · "to log in"
Voyti is a highly customizable and extensible user management, authentication, and authorization extension for Yii 3.
Originally ported from Usuario, Voyti has since been rebuilt around modern PSR standards and Yiisoft components. It has been extensively redesigned to provide a flexible, modular foundation that adapts to a wide range of authentication and authorization requirements.
Features
User management
Registration, email confirmation, login/logout with remember-me, password recovery, password expiration
Profile management
User profiles with gravatar, timezone, bio, and a personal website link
Social authentication
OAuth2 login via Google, GitHub, Facebook, and more
Two-factor authentication
Email codes, TOTP (authenticator app) with QR provisioning, or WebAuthn/passkeys, with enforced-per-permission support and one-time backup codes for account recovery
RBAC Management
Full admin UI for roles, permissions, and rules with parent-child hierarchy, assignment management, and filtering
Identity switching
Admins can temporarily switch into another user's identity for support or debugging, then restore their own session with one click
Session management
Session tracking and termination
GDPR data handling
Data export and account anonymization
Password policies
Minimum complexity requirements, max age enforcement via middleware
Email change confirmation
Three modes: immediate, confirm new address, confirm both old and new
REST API: user management
JSON user CRUD (Bearer-token auth), with optional per-user request throttling (429 responses, X-Rate-Limit-* headers)
SCIM provisioning
SCIM 2.0 user and RBAC-group provisioning for identity providers, with discovery, search, bulk operations, and ETag-based concurrency control
REST API: client login & self-service
Credential login, account/session self-service, admin RBAC/audit-log, and dynamic 2FA/social-login/GDPR bridges over JSON, for a browser-based single-page application (SPA) or any other stateless client
Bot Protection
Google reCAPTCHA v2/v3 for registration and login forms
Brute-force protection
Exponential backoff delays for failed login and registration attempts, tracked per IP address
i18n
Built-in translations for multiple languages
Pluggable views
View-agnostic core with Bootstrap 5 views available; alternative UI frameworks can implement the standard interface
Email customization
Mail templates are independently overridable for complete control over transactional email content and styling
Toast notifications
Native Bootstrap toast support with automatic fallback to flash messages