Weave Code
Oauth Subscriber Laravel Package
guzzlehttp/oauth-subscriber
Guzzle middleware for OAuth 1.0 request signing (consumer key/secret + token/secret) compatible with Guzzle 7.11+ and PHP 7.2.5+. Add to a HandlerStack, set auth=oauth, and optionally override token credentials per request.
Guzzle OAuth 1.0 subscriber
Frequently asked questions about Oauth Subscriber
- How do I integrate this OAuth 1.0 subscriber with Laravel’s HttpClient?
- Use `Http::withOptions()` to inject the middleware via a `HandlerStack`. Configure the `Oauth1` subscriber with your consumer/token keys, then pass the stack to the client. Example: `$client = Http::withOptions(['handler' => $stack])` where `$stack` includes the OAuth middleware.
- Does this work with Laravel 10+ and Guzzle 7.x?
- Yes, it’s fully compatible with Laravel 10+ and Guzzle 7.11+. The package aligns with Laravel’s PSR-18 HTTP client abstractions, so no conflicts or deprecated dependencies exist. Tested with PHP 7.2.5+ and up to PHP 8.5.
- Can I override OAuth tokens per request in Laravel?
- Absolutely. Use the `oauth` request option to dynamically pass `token` and `token_secret` for individual requests. Example: `Http::get('endpoint', ['auth' => 'oauth', 'oauth' => ['token' => 'new_token']])`.
- What if my API requires RSA-SHA1 signing instead of HMAC-SHA256?
- RSA-SHA1 is supported but requires `ext-openssl` enabled. Configure the subscriber with `signature_method: 'RSA-SHA1'` and provide a private key path/key string. Validate keys upfront to avoid runtime errors. HMAC-SHA256 is preferred for performance.
- How do I handle credential rotation or multi-tenant OAuth in Laravel?
- Use per-request overrides via the `oauth` option or middleware to inject dynamic credentials. For multi-tenancy, bind the subscriber to Laravel’s service container and resolve credentials from a database or cache. No built-in token refresh exists—implement custom retry logic if needed.
- Will this break if I upgrade to PHP 8.5?
- No, the package fixes PHP 8.5’s non-finite float coercion warnings. RSA-SHA1 signing may still trigger `openssl_error_string()` if keys are invalid, but core OAuth signing remains unaffected. Test with your private keys to confirm compatibility.
- Is there a way to globally enable OAuth signing for all requests?
- Yes, set `'auth' => 'oauth'` in the `withOptions()` array when configuring the HttpClient. This applies OAuth signing to all requests without needing to specify it per call. Example: `Http::withOptions(['handler' => $stack, 'auth' => 'oauth'])`.
- How do I store OAuth credentials securely in Laravel?
- Use Laravel’s `.env` file for development or a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault) for production. Avoid hardcoding secrets in config files. For RSA keys, store encrypted private keys and decrypt them at runtime using Laravel’s encryption services.
- What alternatives exist for OAuth 1.0 in Laravel?
- For OAuth 1.0, this is the most lightweight Guzzle-native solution. Alternatives include `abraham/twitteroauth` (Twitter-specific) or `league/oauth1-client` (more verbose but feature-rich). If your API supports OAuth 2.0, `league/oauth2-client` is a better long-term choice.
- How do I test OAuth 1.0 signing in Laravel?
- Mock the `HandlerStack` in tests to verify OAuth headers. Check for HMAC-SHA256/RSA-SHA1 signatures in the `Authorization` header. Test PHP 8.5 edge cases (e.g., timestamp formatting) and validate per-request credential overrides. Use Laravel’s `Http::fake()` to simulate API responses.
Weaver
How can I help you explore Laravel packages today?