---
title: "PSR-14 Events"
manual: "Passkeys Frontend Authentication"
version: "2.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-passkeys-fe:events-reference@2.0"
source: "DeveloperGuide/Events.rst"
rendered: "2026-09-29T22:18:36+00:00"
---

# PSR-14 Events {#events-reference}

The extension dispatches seven PSR-14 events that third-party
extensions can listen to. All events are in the
`Netresearch\NrPasskeysFe\Event` namespace.

Register a listener in `Configuration/Services.yaml`:

```yaml
MyVendor\MyExt\EventListener\MyListener:
  tags:
    - name: event.listener
      identifier: 'my-ext/passkey-auth'
      event: Netresearch\NrPasskeysFe\Event\AfterPasskeyAuthenticationEvent
```

---

## BeforePasskeyAuthenticationEvent {#beforepasskeyauthenticationevent}

Dispatched before a passkey assertion is verified. The `feUserUid`
is `null` for discoverable-credential (usernameless) logins.

```php
final readonly class BeforePasskeyAuthenticationEvent
{
    public function __construct(
        public readonly ?int $feUserUid,
        public readonly string $assertionJson,
    ) {}
}
```

Use cases: audit logging, custom rate limiting, anomaly detection.

## AfterPasskeyAuthenticationEvent {#afterpasskeyauthenticationevent}

Dispatched after a successful passkey authentication.

```php
final readonly class AfterPasskeyAuthenticationEvent
{
    public function __construct(
        public readonly int $feUserUid,
        public readonly FrontendCredential $credential,
    ) {}
}
```

Use cases: security dashboards, post-login workflows, notifications.

## BeforePasskeyEnrollmentEvent {#beforepasskeyenrollmentevent}

Dispatched before a passkey enrollment ceremony begins. Throw an
exception in the listener to abort enrollment.

```php
final readonly class BeforePasskeyEnrollmentEvent
{
    public function __construct(
        public readonly int $feUserUid,
        public readonly string $siteIdentifier,
        public readonly string $attestationJson,
    ) {}
}
```

Use cases: enrollment rate limiting, allowed-device policies.

## AfterPasskeyEnrollmentEvent {#afterpasskeyenrollmentevent}

Dispatched after a passkey is successfully enrolled.

```php
final readonly class AfterPasskeyEnrollmentEvent
{
    public function __construct(
        public readonly int $feUserUid,
        public readonly FrontendCredential $credential,
        public readonly string $siteIdentifier,
    ) {}
}
```

Use cases: confirmation emails, audit logs, enforcement re-evaluation.

## PasskeyRemovedEvent {#passkeyremovedevent}

Dispatched after a passkey credential is revoked (by the user or an
admin). `revokedBy` is the UID of the actor (user UID for
self-service, admin UID for admin-initiated removal).

```php
final readonly class PasskeyRemovedEvent
{
    public function __construct(
        public readonly FrontendCredential $credential,
        public readonly int $revokedBy,
    ) {}
}
```

Use cases: security alerts, audit logging.

## RecoveryCodesGeneratedEvent {#recoverycodesgeneratedevent}

Dispatched when a new set of recovery codes is generated. The actual
code values are **never** included for security reasons.

```php
final readonly class RecoveryCodesGeneratedEvent
{
    public function __construct(
        public readonly int $feUserUid,
        public readonly int $codeCount,
    ) {}
}
```

Use cases: email notification, audit logging.

## EnforcementLevelResolvedEvent {#enforcementlevelresolvedevent}

**Mutable event.** Dispatched when the effective enforcement level has
been computed for a user. Listeners can call `setEffectiveLevel()`
to override the resolved level.

```php
final class EnforcementLevelResolvedEvent
{
    public function __construct(
        public readonly int $feUserUid,
        private string $effectiveLevel,
    ) {}

    public function getEffectiveLevel(): string { ... }
    public function setEffectiveLevel(string $level): void { ... }
}
```

The level is a string (`off`, `encourage`, `required`,
`enforced`) to avoid a hard compile-time dependency on the
`EnforcementLevel` enum from `nr-passkeys-be`.

Use cases: custom enforcement overrides (e.g. exempting staff users,
IP-based enforcement).

> [!NOTE]
> Magic link login (including `MagicLinkRequestedEvent`) is deferred
> to v0.2. See [ADR-011](https://docs.typo3.org/permalink/netresearch/nr-passkeys-fe:adr-011-magic-link-recovery-deferred-to-v0-2@2.0).