PHPackages klapaudius/oauth2-php - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. klapaudius/oauth2-php ActiveLibrary[Authentication & Authorization](/categories/authentication) klapaudius/oauth2-php ===================== OAuth2 library 1.10.0(3mo ago)0835.6k↓30%23MITPHPPHP ^7.1.3 || ^7.2.5 || ^8.0.0 || ^8.2.0 || ^8.3.0CI passing Since Apr 15Pushed 1w agoCompare [ Source](https://github.com/klapaudius/oauth2-php)[ Packagist](https://packagist.org/packages/klapaudius/oauth2-php)[ Docs](https://github.com/klapaudius/oauth2-php)[ RSS](/packages/klapaudius-oauth2-php/feed)WikiDiscussions master Synced 2w ago READMEChangelog (8)Dependencies (5)Versions (26)Used By (3) OAuth2 Server Implementation ============================ [](#oauth2-server-implementation) [![Tests](https://github.com/klapaudius/oauth2-php/actions/workflows/coverage.yml/badge.svg?branch=master)](https://github.com/klapaudius/oauth2-php/actions/workflows/coverage.yml)[![codecov](https://camo.githubusercontent.com/9e1424a8de2064b8e731d0a12923504720f54354e522c813154cfea12db14169/68747470733a2f2f636f6465636f762e696f2f67682f6b6c61706175646975732f6f61757468322d7068702f67726170682f62616467652e7376673f746f6b656e3d514a36484e424a4f3331)](https://codecov.io/gh/klapaudius/oauth2-php)[![Packagist Downloads](https://camo.githubusercontent.com/068ff486667b9c156954c5dceb17d15ff6e443b1da17e94d86baa4935aa13fb1/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6b6c61706175646975732f6f61757468322d706870)](https://camo.githubusercontent.com/068ff486667b9c156954c5dceb17d15ff6e443b1da17e94d86baa4935aa13fb1/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6b6c61706175646975732f6f61757468322d706870) An OAuth 2.0 **authorization server** for PHP, implementing draft 20 of the specification, with the OpenID Connect hooks needed to issue `id_token` claims. The library is framework-agnostic: it only depends on [HttpFoundation](https://github.com/symfony/http-foundation) for request/response handling and on [PSR-14](https://www.php-fig.org/psr/psr-14/) for its event hook. You provide the storage. Requirements ------------ [](#requirements) PHP 8.2 or later. Installation ------------ [](#installation) ``` composer require klapaudius/oauth2-php ``` Using Symfony? [klapaudius/oauth-server-bundle](https://github.com/klapaudius/FOSOAuthServerBundle)wires this library into a Symfony application, with Doctrine ORM/ODM storage, controllers and a security authenticator already provided. Usage ----- [](#usage) Implement the storage interface(s) matching the grant types you want to support, then let `OAuth2` handle the endpoints: ``` use OAuth2\OAuth2; $oauth = new OAuth2($myStorage); // Token endpoint — returns a HttpFoundation Response, either the token or the OAuth2 error try { $response = $oauth->grantAccessToken($request); } catch (\OAuth2\OAuth2ServerException $e) { $response = $e->getHttpResponse(); } // Authorize endpoint, once the end-user has approved (or denied) the request $response = $oauth->finishClientAuthorization($isApproved, $user, $request); // Resource endpoint $token = $oauth->verifyAccessToken($oauth->getBearerToken($request), 'my_scope'); ``` Every failure is an `OAuth2ServerException` (or one of its subclasses, `OAuth2AuthenticateException` and `OAuth2RedirectException`), and `getHttpResponse()` turns any of them into the response the specification prescribes — right status code, JSON error body, or redirect back to the client. ### Storage interfaces [](#storage-interfaces) `IOAuth2Storage` is mandatory; each grant type adds one interface to implement: InterfaceEnables`IOAuth2Storage`client lookup and access tokens (required)`IOAuth2GrantCode``authorization_code``IOAuth2GrantUser``password``IOAuth2GrantClient``client_credentials``IOAuth2GrantImplicit`implicit flow (`response_type=token`)`IOAuth2RefreshTokens``refresh_token`, including token rotation`IOAuth2GrantExtension`extension grants (`urn:` or absolute URI)You only implement what you actually serve: the token endpoint rejects a grant whose interface is missing with `unsupported_grant_type`, and the authorize endpoint answers `unsupported_response_type`. OpenID Connect -------------- [](#openid-connect) The library issues OAuth2 tokens; it does not build `id_token` JWTs for you. Instead it publishes an event on every successful grant, carrying everything an OIDC layer needs — including the `nonce` and the authentication time bound to the authorization code: ``` use OAuth2\OAuth2; use OAuth2\OAuthTokenGrantedEvent; $oauth = new OAuth2($myStorage, [], $eventDispatcher); ``` ``` public function onTokenGranted(OAuthTokenGrantedEvent $event): void { $token = $event->getToken(); $token['id_token'] = $this->buildIdToken( $event->getUser(), $event->getClient(), $event->getNonce(), // the "nonce" sent to the authorize endpoint, replayed here $event->getAuthTime() // when the end-user actually authenticated ); $event->setToken($token); } ``` Whatever you set with `setToken()` is what the client receives. Subscribe on `OAuthTokenGrantedEvent::NAME`. Two notes on these two values: - `nonce` is read from the authorization request, stored on the authorization code by your storage, and handed back on the token request. It is `null` for grant types that involve no authorization code. - `auth_time` is **never** read from the request — only your application knows when its user authenticated. Stamp it on the authorization code when you create it; left unset, it arrives as `null` and you simply omit the claim. Upgrading --------- [](#upgrading) Version 3.0 removes the legacy client-side implementation and detaches clients from the Symfony security layer. See [CHANGELOG.txt](CHANGELOG.txt) for the BC breaks. Contributing ------------ [](#contributing) ``` composer install vendor/bin/phpunit # test suite vendor/bin/phpstan analyse # static analysis, level 8 ``` Both run in CI on PHP 8.2 through 8.5. Patches are expected to keep PHPStan clean at level 8 and to come with tests. History ------- [](#history) This library is a fork of , itself a fork of (the original, long abandoned). Compared to the quizlet version it is namespaced, PSR-4 autoloaded, free of `require(_once)`, built on HttpFoundation, and considerably better covered by tests. ### Health Score 65 — FairBetter than 99% of packages Maintenance91 Actively maintained with recent releases Popularity40 Moderate usage in the ecosystem Community28 Small or concentrated contributor base Maturity88 Battle-tested with a long release history Bus Factor3 3 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~214 days Total 25 Last Release 92d ago PHP version history (7 changes)1.0.0PHP >=5.3.2 1.2.3PHP ^5.5.9|>=7.0.8 1.3.0PHP ^5.5.9|^7.0.8|^7.1.3|^7.2.5 1.3.1PHP ^5.5.9 || ^7.0.8 || ^7.1.3 || ^7.2.5 || ^8.0.0 1.6.0PHP ^5.5.9 || ^7.0.8 || ^7.1.3 || ^7.2.5 || ^8.0.0 || ^8.2.0 1.7.0PHP ^7.1.3 || ^7.2.5 || ^8.0.0 || ^8.2.0 1.9.0PHP ^7.1.3 || ^7.2.5 || ^8.0.0 || ^8.2.0 || ^8.3.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/64e21dad1586abffda80d609d01d811b2a384911803d32141fad9d00fd1088c7?d=identicon)[klapaudius](/maintainers/klapaudius) --- Top Contributors [![arnaud-lb](https://avatars.githubusercontent.com/u/365207?v=4)](https://github.com/arnaud-lb "arnaud-lb (42 commits)")[![alanbem](https://avatars.githubusercontent.com/u/320410?v=4)](https://github.com/alanbem "alanbem (21 commits)")[![willdurand](https://avatars.githubusercontent.com/u/217628?v=4)](https://github.com/willdurand "willdurand (18 commits)")[![hswong3i](https://avatars.githubusercontent.com/u/780562?v=4)](https://github.com/hswong3i "hswong3i (14 commits)")[![opendining](https://avatars.githubusercontent.com/u/645450?v=4)](https://github.com/opendining "opendining (8 commits)")[![stof](https://avatars.githubusercontent.com/u/439401?v=4)](https://github.com/stof "stof (5 commits)")[![robocoder](https://avatars.githubusercontent.com/u/922051?v=4)](https://github.com/robocoder "robocoder (5 commits)")[![SebScoFr](https://avatars.githubusercontent.com/u/22073633?v=4)](https://github.com/SebScoFr "SebScoFr (5 commits)")[![stloyd](https://avatars.githubusercontent.com/u/67402?v=4)](https://github.com/stloyd "stloyd (4 commits)")[![vbardales](https://avatars.githubusercontent.com/u/1446444?v=4)](https://github.com/vbardales "vbardales (3 commits)")[![klapaudius](https://avatars.githubusercontent.com/u/610451?v=4)](https://github.com/klapaudius "klapaudius (3 commits)")[![adrienbrault](https://avatars.githubusercontent.com/u/611271?v=4)](https://github.com/adrienbrault "adrienbrault (3 commits)")[![aaronpk](https://avatars.githubusercontent.com/u/113001?v=4)](https://github.com/aaronpk "aaronpk (2 commits)")[![asuth](https://avatars.githubusercontent.com/u/46909?v=4)](https://github.com/asuth "asuth (2 commits)")[![borisDigitalinsure](https://avatars.githubusercontent.com/u/75781378?v=4)](https://github.com/borisDigitalinsure "borisDigitalinsure (2 commits)")[![GuilhemN](https://avatars.githubusercontent.com/u/6871899?v=4)](https://github.com/GuilhemN "GuilhemN (2 commits)")[![jasongrimes](https://avatars.githubusercontent.com/u/847646?v=4)](https://github.com/jasongrimes "jasongrimes (2 commits)")[![Nyholm](https://avatars.githubusercontent.com/u/1275206?v=4)](https://github.com/Nyholm "Nyholm (1 commits)")[![pauliuspetronis](https://avatars.githubusercontent.com/u/9326532?v=4)](https://github.com/pauliuspetronis "pauliuspetronis (1 commits)")[![pyrech](https://avatars.githubusercontent.com/u/2021641?v=4)](https://github.com/pyrech "pyrech (1 commits)") --- Tags oauthoauth2 ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/klapaudius-oauth2-php/health.svg) ``` [![Health](https://phpackages.com/badges/klapaudius-oauth2-php/health.svg)](https://phpackages.com/packages/klapaudius-oauth2-php) ``` ### Alternatives [symfony/security-bundle Provides a tight integration of the Security component into the Symfony full-stack framework 2.5k190.0M2.6k](/packages/symfony-security-bundle)[simplesamlphp/simplesamlphp A PHP implementation of a SAML 2.0 service provider and identity provider. 1.1k13.2M233](/packages/simplesamlphp-simplesamlphp)[symfony/security-http Symfony Security Component - HTTP Integration 1.7k181.7M444](/packages/symfony-security-http)[shopware/platform The Shopware e-commerce core 3.4k1.5M3](/packages/shopware-platform)[drupal/core-recommended Locked core dependencies; require this project INSTEAD OF drupal/core. 6943.5M449](/packages/drupal-core-recommended)[typo3/cms TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL. 1.2k1.9M122](/packages/typo3-cms) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)