Weave Code
Oauth Subscriber Laravel Package
guzzlehttp/oauth-subscriber
Guzzle middleware that signs HTTP requests with OAuth 1.0. Compatible with Guzzle 7.10+ and PHP 7.2.5+. Configure consumer/token secrets once on a HandlerStack, then enable per request (auth=oauth) or globally, with optional per-request token override.
Signs Guzzle requests using OAuth 1.0
Frequently asked questions about Oauth Subscriber
- How do I integrate Guzzle OAuth Subscriber with Laravel’s HttpClient?
- Use `HttpClient::withOptions()` to inject the middleware into Laravel’s default client. Configure the `HandlerStack` with the `Oauth1` subscriber and pass it via the `handler` option. This avoids hardcoding credentials in routes or controllers.
- Does this package support OAuth 1.0a (three-legged OAuth) or only two-legged?
- This package fully supports OAuth 1.0a (three-legged OAuth) with token and token_secret. You can also use it for two-legged OAuth by omitting the token/token_secret fields in the configuration. The middleware handles both flows dynamically.
- What’s the best way to store OAuth credentials securely in Laravel?
- Store credentials in Laravel’s `.env` file (e.g., `OAUTH_CONSUMER_KEY`, `OAUTH_TOKEN_SECRET`) and load them in a service provider or config file. Avoid hardcoding secrets in code. For production, consider using Laravel Forge, Vault, or AWS Secrets Manager.
- Can I use this with Laravel 9+ and Guzzle 7+ without conflicts?
- Yes, this package is fully compatible with Laravel 9+ and Guzzle 7+. Laravel’s default HttpClient uses Guzzle 7, and the OAuth Subscriber is designed for Guzzle 7.10+. No additional dependencies or conflicts exist.
- How do I handle per-request token overrides for different API endpoints?
- Use the `oauth` request option to override `token` and `token_secret` for individual requests while keeping the base consumer credentials. Example: `$client->get('endpoint', ['auth' => 'oauth', 'oauth' => ['token' => 'new_token']])`.
- What signing methods does this package support, and which should I use?
- The package supports HMAC-SHA1 (default) and RSA-SHA1 signing methods. Use HMAC-SHA1 for most cases (faster, no OpenSSL dependency). RSA-SHA1 requires the `ext-openssl` PHP extension and is needed for APIs requiring asymmetric signing.
- How do I debug failed OAuth signatures or API rejections?
- Enable Guzzle middleware logging to inspect signed requests. Add a tap middleware to log headers: `$stack->push(Middleware::tap(function ($request) { Log::debug('OAuth Headers', $request->getHeaders()); }));`. Check for errors like `oauth_problem` in API responses.
- Is there a performance impact with RSA-SHA1 signing in high-traffic Laravel apps?
- Yes, RSA-SHA1 signing is CPU-intensive and can slow down requests. For high-traffic apps, prefer HMAC-SHA1 or offload signing to a dedicated service. Monitor response times and consider caching signed requests if applicable.
- Can I use this package with Laravel’s queue system for background OAuth requests?
- Yes, you can use the OAuth Subscriber with Laravel queues by creating a custom Guzzle client with the middleware in a job. Example: `$client = new Client(['handler' => $stack]);` and pass it to the job’s `handle()` method.
- What alternatives exist for OAuth 1.0 in Laravel if this package doesn’t fit my needs?
- Alternatives include the `league/oauth1-client` package (more feature-rich but heavier) or rolling a custom solution using Guzzle’s `Authorization` header. However, this package is the most lightweight and Laravel-friendly for OAuth 1.0 middleware integration.
Weaver
How can I help you explore Laravel packages today?