PHPackages                             iansimpson/ss-oauth2-server - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. iansimpson/ss-oauth2-server

ActiveSilverstripe-vendormodule[Authentication & Authorization](/categories/authentication)

iansimpson/ss-oauth2-server
===========================

Silverstripe OAuth 2.0 Server

2.0.0(1mo ago)17.4k↑88.5%7[2 issues](https://github.com/IanSimpson/ss-oauth2-server/issues)[1 PRs](https://github.com/IanSimpson/ss-oauth2-server/pulls)MITPHPPHP ^8.3CI passing

Since Dec 20Pushed 1mo ago2 watchersCompare

[ Source](https://github.com/IanSimpson/ss-oauth2-server)[ Packagist](https://packagist.org/packages/iansimpson/ss-oauth2-server)[ Docs](https://logicstudio.nz)[ RSS](/packages/iansimpson-ss-oauth2-server/feed)WikiDiscussions master Synced 3w ago

READMEChangelog (10)Dependencies (25)Versions (19)Used By (0)

OAuth2 Server
=============

[](#oauth2-server)

Introduction 👋
--------------

[](#introduction-)

This allows your Silverstripe site to be in OAuth 2.0 provider.

Please note that this is under development. It should work just fine, but has not been extensively tested, and is poorly documented.

It supports the following grants:

- Authorization code grant
- Refresh grant

⚠️ Upgrade Warning
------------------

[](#️-upgrade-warning)

### Grant Type Validation

[](#grant-type-validation)

Grant type validation has been updated to strictly match the grant type stored in the Silverstripe CMS against the grant type sent in the request. Previously, these could differ without causing an error.

**Action required:** If you are upgrading from previous module version or upgrading to CMS version 6, you must ensure that the **Grant Type value stored against each OAuth client in the CMS** matches the grant type used in your access token requests (e.g. `authorization_code`, `client_credentials`). Mismatched values will now cause the token request to be rejected.

---

Requirements 🦺
--------------

[](#requirements-)

- PHP ^8.1
- Silverstripe ^4.13

Installation 👷‍♀️
-----------------

[](#installation-‍️)

Install the add-on with Composer:

```
composer require iansimpson/ss-oauth2-server
```

Next, generate a private/public key pair:

```
openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.key
chmod 600 private.key
chmod 600 public.key
```

Put these on your web server, somewhere outside the web root

Generate encryption key:

```
php -r 'echo base64_encode(random_bytes(36)), PHP_EOL;'
```

Add the following lines in your `.env`, updating the `OAUTH_PRIVATE_KEY_PATH` and `OAUTH_PUBLIC_KEY_PATH` to point to the key files, and adding the encryption key you have just generated:

```
OAUTH_PRIVATE_KEY_PATH="/path/to/my/private.key"
OAUTH_PUBLIC_KEY_PATH="/path/to/my/public.key"
OAUTH_ENCRYPTION_KEY="my-encryption-key"
```

Finally, after doing a `/dev/build/` go into your site settings and on the OAuth Configuration and add a new Client. Using this you should now be able to generate a key at `/oauth/authorize`, per the OAuth 2.0 spec ().

Usage 🏃🏃🏃
---------

[](#usage-)

To verify the Authorization header being submitted is correct, add this to your Controller:

```
$member = IanSimpson\OAuth2\OauthServerController::getMember($this);
```

it will return a Member object if the Authorization header is correct, or null if there's an error. Simple!

###  Health Score

55

—

FairBetter than 97% of packages

Maintenance74

Regular maintenance activity

Popularity27

Limited adoption so far

Community18

Small or concentrated contributor base

Maturity87

Battle-tested with a long release history

 Bus Factor3

3 contributors hold 50%+ of commits

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~205 days

Recently: every ~689 days

Total

16

Last Release

31d ago

Major Versions

0.1.7 → 1.0.02024-03-14

1.x-dev → 2.0.02026-05-24

PHP version history (2 changes)1.0.0PHP ^8.1

2.0.0PHP ^8.3

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/782493?v=4)[Ian](/maintainers/IanSimpson)[@IanSimpson](https://github.com/IanSimpson)

---

Top Contributors

[![mikenuguid](https://avatars.githubusercontent.com/u/44601742?v=4)](https://github.com/mikenuguid "mikenuguid (19 commits)")[![Cambis](https://avatars.githubusercontent.com/u/12287346?v=4)](https://github.com/Cambis "Cambis (17 commits)")[![mateusz](https://avatars.githubusercontent.com/u/118653?v=4)](https://github.com/mateusz "mateusz (16 commits)")[![satrun77](https://avatars.githubusercontent.com/u/166450?v=4)](https://github.com/satrun77 "satrun77 (13 commits)")[![jareddreyerss](https://avatars.githubusercontent.com/u/56658401?v=4)](https://github.com/jareddreyerss "jareddreyerss (11 commits)")[![Jianbinzhu](https://avatars.githubusercontent.com/u/11606683?v=4)](https://github.com/Jianbinzhu "Jianbinzhu (5 commits)")[![IanSimpson](https://avatars.githubusercontent.com/u/782493?v=4)](https://github.com/IanSimpson "IanSimpson (2 commits)")

---

Tags

silverstripeoauthoauth2oauth 2.0oauth 2

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StylePHP\_CodeSniffer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/iansimpson-ss-oauth2-server/health.svg)

```
[![Health](https://phpackages.com/badges/iansimpson-ss-oauth2-server/health.svg)](https://phpackages.com/packages/iansimpson-ss-oauth2-server)
```

###  Alternatives

[league/oauth2-server

A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API.

6.7k143.0M272](/packages/league-oauth2-server)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

585.4M518](/packages/shopware-core)[league/openid-connect-claims

An OpenID Connect ID claims set implementation

16254.4k3](/packages/league-openid-connect-claims)[chervand/yii2-oauth2-server

OAuth 2.0 server for Yii 2.0 with MAC tokens support.

1524.5k1](/packages/chervand-yii2-oauth2-server)[bigfork/silverstripe-oauth-login

SilverStripe logins via OAuth2, using the PHP League's OAuth2 client

1897.4k2](/packages/bigfork-silverstripe-oauth-login)[silverstripe/mfa

Enable multi-factor authentication with fallback codes

10358.1k11](/packages/silverstripe-mfa)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)