- How do I install laravel-sso-server in my Laravel application?
- Install the package with Composer using composer require jeffersongoncalves/laravel-sso-server, then publish and review its configuration before registering any client applications. Laravel package auto-discovery should register the service provider, so a manual provider entry is usually unnecessary. After configuring signing keys and your first-party clients, test the authorization and logout endpoints in a non-production environment.
- Which Laravel and PHP versions are supported?
- The exact version constraints are defined in the package's composer.json, so check that file or its Packagist page before installing. The overview does not list specific Laravel or PHP versions, so confirm compatibility with your application's framework and runtime. If you are on an older Laravel release, verify support before adopting the package.
- How does the Authorization Code flow with PKCE work in this package?
- A client application redirects the user to the SSO server's authorization endpoint, where the user authenticates against the central Laravel identity provider. After a successful login, the server issues a one-time authorization code that the client exchanges for tokens, including the PKCE code verifier so intercepted codes cannot be redeemed. This keeps authentication centralized while each first-party app manages its own local session.
- Does it sign tokens with RS256 and provide a JWKS endpoint?
- Yes. The package issues RS256-signed JWTs and exposes a JWKS endpoint so client applications can fetch public keys and verify token signatures locally. That means clients do not need to call the SSO server on every request just to validate a token. Use the JWKS document as the source of truth for current verification keys.
- How does signing key rotation work?
- The SSO server supports key rotation and publishes signing keys through JWKS, allowing clients to verify tokens signed by the current or previous key during a rollover. Plan rotations with an overlap window so existing tokens remain valid until they expire, and make sure clients refresh cached JWKS data periodically. Avoid removing an old public key until every token signed with it has expired.
- How does back-channel Single Logout work with client apps?
- When a user logs out of the central SSO session, the server notifies participating client applications through back-channel logout webhooks rather than relying only on browser redirects. Each client should validate the logout request and invalidate its local session so the user is signed out everywhere. Back-channel delivery is more reliable than front-channel redirects, but clients should still handle retries and duplicate notifications safely.
- Is this a replacement for Laravel Passport or Sanctum?
- This package is focused on acting as a central SSO identity provider for multiple first-party Laravel applications, including one-time authorization codes, JWKS-verifiable JWTs, and single logout. Passport is a broader OAuth2 server for issuing API tokens, while Sanctum is aimed at first-party SPA and API authentication inside a single app. You can keep Sanctum within client applications while this server centralizes login across your ecosystem.
- How do I test the SSO login and logout flow locally?
- Register a local client application with a valid redirect URI and point it at your development SSO server, then exercise the full authorization code plus PKCE exchange. Trigger a logout and confirm that the back-channel webhook reaches the client and invalidates its session. Use Laravel's HTTP testing helpers and fake HTTP calls so the login, code exchange, and logout notification paths are covered in automated tests.
- What should I check before using it in production?
- Serve the SSO server over HTTPS only, store private signing keys securely outside source control, and establish a key rotation and JWKS caching policy for clients. Monitor authorization, token, and logout endpoints, and make client logout webhook handlers idempotent with retry handling. Also verify clock synchronization and token lifetimes so validation does not fail due to skew.
- Is jeffersongoncalves/laravel-sso-server actively maintained, and what are the alternatives?
- Check the package's Packagist release history and GitHub repository for recent commits, open issues, and Laravel version support before committing to it. Alternatives include Laravel Passport for full OAuth2 server needs, or external identity providers such as Keycloak, Auth0, or Ory Hydra if you prefer not to run your own SSO server. Evaluate maintenance activity and your logout and key-rotation requirements when comparing options.