PHPackages wapplersystems/oauth-service - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. wapplersystems/oauth-service ActiveTypo3-cms-extension[Authentication & Authorization](/categories/authentication) wapplersystems/oauth-service ============================ Central OAuth2 client and token management for TYPO3 — Authorization Code Flow with PKCE, encrypted token storage, automatic refresh and expiry monitoring 14.2.2(4w ago)09111GPL-2.0-or-laterPHP Since Apr 3Pushed 1mo agoCompare [ Source](https://github.com/WapplerSystems/t3-oauth-service)[ Packagist](https://packagist.org/packages/wapplersystems/oauth-service)[ Docs](https://github.com/WapplerSystems/t3-oauth-service)[ RSS](/packages/wapplersystems-oauth-service/feed)WikiDiscussions release/v14 Synced 3w ago READMEChangelogDependencies (2)Versions (11)Used By (1) OAuth Service for TYPO3 ======================= [](#oauth-service-for-typo3) Central OAuth2 client and token management for TYPO3 v14. Features -------- [](#features) - Manage multiple OAuth2 clients and connections via a backend module - **Authorization Code Flow with PKCE** (RFC 7636, OAuth 2.1 compliant) - Encrypted token storage (libsodium, derived from TYPO3 encryption key) - Automatic token refresh via console command / scheduler - Expiry monitoring with configurable email warnings - Extensible provider system — register custom OAuth providers from any extension Requirements ------------ [](#requirements) - TYPO3 v14 - PHP 8.2+ - `ext-sodium` Installation ------------ [](#installation) ``` composer require wapplersystems/oauth-service ``` Then update the database schema: ``` typo3 extension:setup ``` Configuration ------------- [](#configuration) Extension settings under **Admin Tools > Settings > Extension Configuration > oauth\_service**: SettingDefaultDescription`thresholdSeconds``300`Refresh tokens expiring within this many seconds`debounceMinutes``360`Min. gap between failure notifications per connection`warningEmail`Comma-separated emails for expiry warnings`warningThresholdDays``7,3,1`Days before expiry to send warnings`debounceHours``20`Min. gap between warning emails per connectionUsage ----- [](#usage) ### Backend Module [](#backend-module) The module is available at **System > OAuth Services** (admin only). It lists all configured clients with their connections, token status, and expiry info. ### Registering a Provider [](#registering-a-provider) Providers are registered via a DI tag — `ProviderRegistry`'s constructor consumes a tagged iterator and populates itself at container build time. This makes registered providers visible in any bootstrap mode, **including the TYPO3 Install Tool's failsafe boot** (where extension `ext_localconf.php` files are NOT executed). Use this for any code path the Install Tool might hit, such as the "Test Mail Setup" form when a mail transport depends on OAuth tokens. **Recommended: `Configuration/Services.yaml`** ``` services: _defaults: autowire: true autoconfigure: true public: false # … your other services … my_extension.provider_definition: class: WapplerSystems\OauthService\Provider\ProviderDefinition autowire: false arguments: $identifier: 'my_provider' $title: 'My Provider' $type: 'generic_oauth2' $authorizationUrl: 'https://provider.example/oauth/authorize' $tokenUrl: 'https://provider.example/oauth/token' $defaultScopes: ['read', 'write'] tags: - 'oauth_service.provider_definition' ``` **Equivalent: `Configuration/Services.php`** ``` use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator; use WapplerSystems\OauthService\Provider\ProviderDefinition; return static function (ContainerConfigurator $container): void { $services = $container->services() ->defaults() ->autowire() ->autoconfigure(); $services->load('Vendor\\MyExtension\\', __DIR__ . '/../Classes/*'); $services->set('my_extension.provider_definition', ProviderDefinition::class) ->autowire(false) ->args([ '$identifier' => 'my_provider', '$title' => 'My Provider', '$type' => 'generic_oauth2', '$authorizationUrl' => 'https://provider.example/oauth/authorize', '$tokenUrl' => 'https://provider.example/oauth/token', '$defaultScopes' => ['read', 'write'], ]) ->tag('oauth_service.provider_definition'); }; ``` #### Legacy: imperative registration [](#legacy-imperative-registration) Older releases registered providers via `ext_localconf.php`: ``` $registry = GeneralUtility::makeInstance(ProviderRegistryInterface::class); $registry->register(new ProviderDefinition( identifier: 'my_provider', title: 'My Provider', type: 'generic_oauth2', /* … */ )); ``` This still works — `register()` is idempotent by identifier, so existing code is not broken by the DI-tag mechanism. However, providers registered only this way are **invisible to the Install Tool's failsafe bootstrap**, so prefer the DI-tag pattern above. ### Retrieving Tokens [](#retrieving-tokens) Use `OAuthClientService` to get decrypted access tokens: ``` use WapplerSystems\OauthService\Service\OAuthClientService; class MyService { public function __construct( private readonly OAuthClientService $oAuthClientService, ) {} public function callApi(): void { $connection = $this->oAuthClientService->getActiveConnectionByProvider('my_provider'); $accessToken = $connection['access_token']; // use $accessToken for API calls } } ``` ### Console Commands [](#console-commands) **Refresh expiring tokens** (recommended: every 5 minutes via scheduler): ``` typo3 oauth-service:refresh-tokens typo3 oauth-service:refresh-tokens --uid 3 --force typo3 oauth-service:refresh-tokens --threshold 600 ``` **Monitor connections** (recommended: daily): ``` typo3 oauth-service:monitor-connections ``` Security -------- [](#security) - All tokens and client secrets are encrypted with libsodium (XSalsa20-Poly1305) - CSRF protection via state parameter with SHA-256 hash and 10-minute timeout - PKCE (S256) on every authorization code flow - Token fields are read-only in the backend UI License ------- [](#license) GPL-2.0-or-later ### Health Score 41 — FairBetter than 87% of packages Maintenance92 Actively maintained with recent releases Popularity14 Limited adoption so far Community9 Small or concentrated contributor base Maturity40 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~8 days Total 9 Last Release 28d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/a944bb90af783b13d74049f2d8adcff598f4e7cb0aad9d7040a6af0bb8c23984?d=identicon)[svewap](/maintainers/svewap) --- Top Contributors [![svewap](https://avatars.githubusercontent.com/u/1734738?v=4)](https://github.com/svewap "svewap (56 commits)") --- Tags oauthoauth2typo3typo3-cms-extensionAuthenticationoauthoauth2extensiontypo3 ### Embed Badge ![Health badge](/badges/wapplersystems-oauth-service/health.svg) ``` [![Health](https://phpackages.com/badges/wapplersystems-oauth-service/health.svg)](https://phpackages.com/packages/wapplersystems-oauth-service) ``` ### Alternatives [league/oauth2-server A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API. 6.7k147.0M304](/packages/league-oauth2-server)[calcinai/oauth2-xero Xero OAuth 2.0 Client Provider for The PHP League OAuth2-Client 103.4M4](/packages/calcinai-oauth2-xero) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)