Weave Code
Auth0 Php Laravel Package
auth0/auth0-php
The official Auth0 PHP SDK for Authentication and Management APIs. Build PHP 8.2+ apps with PSR-18/17/7 HTTP support and tailored Laravel, Symfony, and WordPress SDKs. Includes quickstarts for session-based web apps and token-protected backend APIs.
PHP SDK for Auth0 Authentication and Management APIs.
Frequently asked questions about Auth0 Php
- How do I install auth0/auth0-php in a Laravel application?
- Install it with Composer by running composer require auth0/auth0-php. The package requires PHP 8.2 or newer, the mbstring extension, and PSR-18, PSR-17, and PSR-7 HTTP implementations. Laravel already ships with compatible Guzzle-based HTTP factories, so no extra wiring is usually needed. After installation, bind the Auth0 client in a service provider so configuration is resolved once.
- Does auth0/auth0-php support Laravel 11 and PHP 8.2+?
- Yes. The SDK targets PHP 8.2 and above and is framework-agnostic, so it runs fine inside Laravel 10, 11, and newer releases. It relies only on PSR interfaces rather than Laravel-specific code, which keeps it compatible across framework versions. If you want tighter, opinionated Laravel integration, the separate auth0/laravel-auth0 package is built on top of this SDK.
- Should I use auth0/auth0-php or the auth0/laravel-auth0 package?
- Use auth0/laravel-auth0 if you want a ready-made Laravel integration with guards, middleware, and Blade directives already wired up. Choose the generic auth0/auth0-php SDK for APIs, microservices, console commands, and custom flows where the Laravel package does not fit. The Laravel package is built on top of the generic SDK, so the underlying Auth0 behavior is the same. Many teams use both, with the generic client for Management API automation.
- How do I register the Auth0 SDK as a singleton in a Laravel service provider?
- Bind the Auth0 class in a service provider using $this->app->singleton(Auth0::class, ...) and construct it with an SdkConfiguration built from your config values. Pass domain, clientId, clientSecret, and cookieSecret from config('auth0.*') so credentials stay out of code. Resolving it as a singleton means configuration is read once and the same client instance is injected consistently. You can then type-hint Auth0 in controllers, middleware, and jobs.
- How do I protect Laravel API routes with Auth0 access tokens?
- For stateless APIs, build an Authenticate middleware that calls the SDK's getCredentialsFromToken() method with the incoming bearer token and rejects the request when validation fails. This avoids session handling entirely, which is what you want for headless SPAs, mobile clients, and service-to-service calls. Keep stateful session checks in a separate middleware so API and web routes do not share credential logic. Register the middleware on your api route group in bootstrap/app.php or your HTTP kernel.
- How do I manage Auth0 users and roles from Laravel with the Management API?
- The SDK separates the Authentication API from the Management API, and the Management client covers users, roles, and increasingly tenant configuration. You request a Management API token with the appropriate scopes and then call the typed client methods from controllers, jobs, or artisan commands. Because the client is PSR-18 based, you can inject it anywhere in Laravel's container. This makes user provisioning from seeders or console commands practical.
- What are the PSR-18, PSR-17, and PSR-7 requirements for auth0/auth0-php?
- The SDK does not bundle an HTTP client. It depends on PSR-18 for sending requests, PSR-17 for creating requests and responses, and PSR-7 for the message objects themselves. In Laravel you typically already have Guzzle and its PSR implementations available, so the SDK works out of the box. If you swap HTTP clients, make sure the new one implements all three interfaces.
- How can I test Auth0 integration in a Laravel app without hitting a real tenant?
- Because HTTP transport goes through PSR-18, you can inject a mock or fake HTTP client in your test container and assert on the outgoing requests instead of calling Auth0. You can also bind a fake Auth0 instance into the container so middleware and controllers resolve a stub during tests. Keep the SDK configuration in a config file so tests can override domain and client values easily. This lets you cover login, token validation, and Management API calls without network access or real credentials.
- Is Auth0 PHP SDK v9 stable, and what changed from v8?
- Yes. At 9.5.0 the v9 line is the shipping baseline, with strongly-typed, OpenAPI-generated requests and responses plus built-in pagination for Management API endpoints. It also fixes ID token verification and validation on the renew() flow, so a renew can no longer accept an unvalidated token. Version 8 is now the legacy path. Note that 9.5.0 removed experiment status endpoints in a minor release, so audit any tooling you built against them.
- What are the production concerns when calling the Auth0 Management API from Laravel?
- The main risk is rate limiting, so prefer server-side search and filtering, such as the new client search support, over listing everything and filtering in PHP. Cache Management API tokens and any tenant configuration you read frequently rather than fetching on every request. Treat the Management client as an admin tool and keep it out of hot user-facing paths. Also be deliberate about stateful versus stateless middleware, since session-based credential helpers do not belong on API routes.
Weaver
How can I help you explore Laravel packages today?