# Disable public registration (invite-only)

The starter kit registers auth routes via Fortify. To disable public signup:

## Option A — Fortify feature flag (cleanest)
In config/fortify.php, REMOVE or comment out Features::registration():

    'features' => [
        // Features::registration(),   <-- remove this line
        Features::resetPasswords(),
        Features::emailVerification(),
        Features::updateProfileInformation(),
        Features::updatePasswords(),
        Features::twoFactorAuthentication(),
    ],

This makes /register return 404 and removes the register endpoint entirely.

## Option B — hide the UI link too
In resources/js/pages/auth/login.tsx, remove the "Sign up" / register link so the
login page doesn't advertise a dead route. (Optional cosmetic step.)

After changing config/fortify.php:
    php artisan config:clear   (or config:cache at go-live)