- What is alt-three/login used for in Laravel?
- Alt Three Login is a Laravel 5 package that wraps a League OAuth 2 server implementation so your application can act as an OAuth 2 authorization server. It is intended for issuing access and refresh tokens to third-party clients rather than for simple first-party SPA or mobile authentication. It integrates with Laravel's auth system but is a thin, dated layer over the underlying League library.
- Does alt-three/login work with Laravel 8, 9, 10, 11, or 12?
- It targets Laravel 5.x only. Modern Laravel 10, 11, and 12 require PHP 8.1+ and League OAuth 2 server v8+, so Composer resolution will usually fail against alt-three/login's pinned constraints. Forcing it through leaves you with an unpatched dependency graph, so it is not a supported option for current Laravel versions.
- How do I install alt-three/login with Composer?
- Install it with Composer using composer require alt-three/login in a Laravel 5 application. You then need to register the package service provider and publish or configure any included config and migration files for clients, tokens, and scopes. In practice, modern Composer installs often fail because the package's Laravel and League version constraints are pinned to the Laravel 5 era.
- Is alt-three/login still maintained and safe for production?
- No. The repository was archived in September 2018, has roughly 15 stars and no dependents, and has no upstream security response capability. Because it is security-critical OAuth infrastructure, the lack of patches for modern OAuth 2.0 Security Best Current Practice updates makes it unsuitable for production.
- What is the difference between alt-three/login and Laravel Passport?
- Laravel Passport is the first-party OAuth 2 server for Laravel, released in 2016 and still maintained, built on the same League OAuth 2 lineage. Alt Three Login is a lower-capability, unmaintained duplicate aimed at Laravel 5. Passport offers full grant-type coverage, framework-version parity, documented upgrades, and a supported migration path for clients and tokens.
- Should I use alt-three/login or Laravel Sanctum for my API?
- Use Sanctum if your requirement is first-party token issuance for your own SPA or mobile app. Sanctum avoids running an OAuth authorization server entirely and has far less surface area to secure. Choose an OAuth server such as Passport only if you genuinely need to issue tokens to external third-party clients.
- Which OAuth 2 grant types does alt-three/login support?
- The package does not document a modern grant matrix; it exposes whatever the pinned League OAuth 2 server generation supports. That era commonly included authorization code, refresh token, password, and implicit grants. Modern best practice deprecates implicit and password grants and requires PKCE for public clients, so verify the pinned league/oauth2-server version before relying on any grant.
- How do I configure alt-three/login in a Laravel 5 application?
- Configuration is handled through the package's Laravel 5 service provider plus any published config and migration files. You need to define OAuth clients, redirect URIs, scopes, token storage, and the user provider that maps to your application's user model. Because the package predates stricter redirect URI matching and PKCE requirements, you must audit those settings yourself rather than assuming secure defaults.
- Can I migrate from alt-three/login to Laravel Passport?
- There is no official migration path from alt-three/login to Passport, so treat it as a security migration project. Map the existing clients and token tables to Passport's schema, reissue or revoke credentials, re-audit redirect URIs and scopes, and add integration tests for token issuance, refresh, and revocation. Passport's documented upgrade guides and supported schema give you a maintainable target.
- How do I test an OAuth flow built with alt-three/login?
- The package shipped with little or no test coverage, so you must write your own integration tests around the OAuth flow. Cover client registration, redirect URI validation, authorization code exchange, refresh token rotation, revocation, and scope enforcement. Use Laravel's HTTP testing helpers against your routes, and consider the maintained Passport test suite as a reference for expected behavior.