Registration

Registration is owned by RegisteredUserController. Your app fills the view seam by binding RegisterView and the action seam with Oidc::createUsersUsing(...); the package owns the event dispatch, sign-in, and session regeneration.

Routes

Route name	Verb	Path	Middleware
identity.register	GET	auth/register	web, guest:identity
identity.register.store	POST	auth/register	web, guest:identity, throttle:5,1

GET identity.register renders through the bound RegisterView contract. If none is bound, hitting the route throws MissingAuthViewException.

The registration flow (POST identity.register.store)

The store action is throttled to 5 requests per minute, then runs the following steps:

1. The full request input is collected, with email lowercased.
2. The createUsersUsing action is invoked with that input array and must return the created Authenticatable.
3. Laravel’s Illuminate\Auth\Events\Registered event is fired for the new user (this is what triggers the email verification notification when your user model implements MustVerifyEmail).
4. The user is logged in on the identity guard.
5. The session is regenerated.

Response

• A JSON request (wantsJson) receives an empty 201 response.
• A browser request is redirected via redirect()->intended(...) to config('oidc.auth.home') (default /dashboard).

Validation lives in your action

The controller does not validate the registration input beyond lowercasing email. Ownership of the rules is yours — enforce them inside your createUsersUsing action (or a form request that feeds it), exactly where your app’s persistence and password hashing already live. This keeps the package out of your user model’s shape:

use Illuminate\Support\Facades\Validator;

class CreateNewUser
{
    public function create(array $input): User
    {
        Validator::make($input, [
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'email', 'unique:users'],
            'password' => ['required', 'confirmed', Password::defaults()],
        ])->validate();

        return User::create([
            'name' => $input['name'],
            'email' => $input['email'],
            'password' => Hash::make($input['password']),
        ]);
    }
}

Register it in a service provider boot():

use Bambamboole\LaravelOidc\Server\Facades\Oidc;

Oidc::createUsersUsing(App\Actions\CreateNewUser::class);

After registration

When your user model implements MustVerifyEmail, the Registered event sends the verification notification and the user is redirected/gated through the email verification flow before reaching protected pages.