Weave Code
Oauth Subscriber Laravel Package
guzzlehttp/oauth-subscriber
OAuth 1.0 middleware for Guzzle that signs outgoing requests with your consumer key, secret, token, and token secret when the auth option is oauth. Add it to a Guzzle handler stack for APIs that require OAuth 1.0 request signing instead of OAuth 2.0 bearer tokens.
guzzlehttp/oauth-subscriber provides OAuth 1.0 middleware for Guzzle, automatically signing outgoing requests when the auth option is set to oauth. It is intended for APIs that require OAuth 1.0 request signing; for OAuth 2.0 bearer tokens, use Guzzle’s standard Authorization: Bearer ... header instead.
- Adds OAuth 1.0 signing through a Guzzle HandlerStack middleware.
- Configures consumer key/secret and token/token secret credentials.
- Supports client-wide defaults via
'auth' => 'oauth'. - Integrates with Guzzle clients using
base_uriand custom handlers. - Requires PHP >=7.4 (1.0) and is MIT licensed.
Frequently asked questions about Oauth Subscriber
- How do I install guzzlehttp/oauth-subscriber in a Laravel application?
- Run composer require guzzlehttp/oauth-subscriber. It is a Guzzle middleware, so no Laravel service provider or config file is required. You then push GuzzleHttp\Subscriber\Oauth\Oauth1 onto a HandlerStack and pass that handler to a Guzzle client or Laravel Http request. Pin a version at or above 0.8.1 to include the nonce entropy security fix; the current line is 1.0.
- Does guzzlehttp/oauth-subscriber work with Laravel's HTTP client?
- Yes. Laravel's Http client is a thin wrapper around Guzzle, so you can supply a custom Guzzle handler stack with the Oauth1 middleware via request options. Signing happens at the transport layer after the request is built, so Laravel does not need to know about OAuth 1.0. You still set auth to 'oauth' on requests that should be signed, or as a client default.
- Which PHP and Laravel versions are supported by guzzlehttp/oauth-subscriber?
- Version 1.0 requires PHP >=7.4,<8.7 and is the latest line; 0.9 is maintenance for PHP >=7.2.5,<8.7. There is no Laravel-specific version constraint because the package only depends on Guzzle ^7.11 and PSR-7 ^2.11. Any Laravel release that uses Guzzle 7 should work. Check the version guidance table before pinning, especially on older Laravel apps.
- How do I sign a Guzzle request with OAuth 1.0 in Laravel?
- Create a HandlerStack, push a new Oauth1 instance with consumer_key, consumer_secret, token, and token_secret, and pass the stack as the handler to your Guzzle client. For each request that needs signing, set auth to 'oauth'; you can also make it a client default if every request should be signed. The middleware adds the OAuth parameters and signature at send time. This keeps credentials out of the code paths that build URLs and bodies.
- Does guzzlehttp/oauth-subscriber support OAuth 2.0 bearer tokens?
- No. It is specifically OAuth 1.0 and 1.0a request-signing middleware. If the API uses OAuth 2.0 bearer tokens, send an Authorization Bearer header with Guzzle or Laravel's Http client and do not install this package. Confirming whether a vendor requires OAuth 1.0 or 2.0 is the first diligence step, because using the wrong one invalidates the integration.
- Which OAuth signature methods does guzzlehttp/oauth-subscriber support?
- It supports HMAC-SHA1, HMAC-SHA256, and RSA-SHA1. RSA-SHA1 requires ext-openssl, while the HMAC methods do not. It also supports oauth_body_hash for APIs that sign form or JSON bodies, plus two-legged OAuth with empty token and token_secret. Set the signature method in the Oauth1 middleware options according to the vendor's documentation.
- Why does my OAuth 1.0 request fail when Guzzle retries it?
- OAuth 1.0 signatures include a nonce and timestamp, so a retried request must be re-signed. If your retry middleware sits outside the Oauth1 middleware and replays an already-signed request, the upstream API can reject it as a stale or reused signature. Push the OAuth middleware so each attempt passes through it again, and avoid caching signed requests. This ordering issue is a common production failure with Guzzle handler stacks.
- Is guzzlehttp/oauth-subscriber safe to use in production?
- It is maintained by the Guzzle organization under MIT, with a changelog and semver releases. A real security advisory, CVE-2025-21617, affected nonce entropy and was fixed in 0.8.1, so pin at or above that version and monitor advisories. Treat it as a pinned, monitored dependency rather than set-and-forget. Also redact oauth request options from logs because they contain secrets.
- Can I use two-legged OAuth or per-request credentials with guzzlehttp/oauth-subscriber?
- Yes. Two-legged OAuth works by supplying empty token and token_secret values. You can also override token and token_secret per request, but both must be provided together; overriding only one will produce incorrect signatures. This is useful for multi-tenant or per-user signing without rebuilding the whole client. Keep the override values out of logs and error reports.
- What are the alternatives to guzzlehttp/oauth-subscriber for OAuth 1.0 in Laravel?
- For Guzzle-based Laravel apps, it is the standard small middleware for OAuth 1.0 signing and is often simpler than pulling in a full OAuth library. Alternative approaches include writing a custom Guzzle middleware or using a general OAuth 1.0 client library, but those add code surface and maintenance. If the vendor has migrated to OAuth 2.0, use bearer tokens with Laravel's Http client instead. Evaluate based on whether you need only request signing or a complete authorization flow with callbacks and token storage.
Weaver
How can I help you explore Laravel packages today?