- How do I install jenssegers/oauth in a Laravel app?
- Install it with composer require jenssegers/oauth, then register the package service provider and OAuth facade alias in your Laravel app. Publish config/oauth.php and add the client_id, client_secret and scope for each provider you need. You then use OAuth::consumer('Provider') as a factory for redirect and callback flows. Because the package is unmaintained, do this first in a time-boxed non-production spike.
- Which Laravel versions does jenssegers/oauth support?
- Documentation is from the Laravel 4/5 era, but you should not trust the README version claims for a current install. Verify the Composer constraints against your exact PHP and Laravel pair in a non-production spike. Check that lusitanian/phpoauthlib resolves without known-vulnerable transitive versions before committing. If the dependency tree fails, treat the package as incompatible rather than patching around it.
- Is jenssegers/oauth a replacement for Laravel Passport or Sanctum?
- No. jenssegers/oauth is an OAuth consumer library built on Lusitanian/PHPoAuthLib, so it handles outbound logins to third-party providers. It does not issue tokens and is not an identity provider. Use Laravel Passport or Sanctum when your application needs to issue and manage its own API tokens.
- Does jenssegers/oauth support OAuth 1.0a as well as OAuth 2?
- Yes, it supports both OAuth 1.0a and OAuth 2.0 through Lusitanian/PHPoAuthLib. That can be useful for legacy OAuth 1.0a providers that Laravel Socialite does not cover. However, provider endpoints drift and the upstream library is no longer actively developed, so verify each flow against current provider behavior. Do not assume the demo flow equals your production requirements.
- Is jenssegers/oauth still maintained?
- There is no observable maintenance signal: the package has 0 dependents and a package score of about 0.3, and its upstream PHPoAuthLib is also no longer actively developed. That creates a two-deep unmaintained chain on the authentication path. Treat it as high risk and avoid using it as the primary login path. If you must use it, assign an internal owner and document an exit plan.
- What providers does jenssegers/oauth support out of the box?
- It ships ready-made drivers for Twitter, Facebook, Google, LinkedIn, GitHub and more via Lusitanian/PHPoAuthLib. The exact provider list and supported flows matter, because OAuth failures often appear only when a provider changes a parameter. Confirm the providers and OAuth versions you need at launch against current endpoints. Do not rely on the package README as current truth.
- Should I use jenssegers/oauth or Laravel Socialite?
- For OAuth 2.0 social login in a maintained Laravel app, default to Laravel Socialite. If Socialite lacks a provider, write a small custom Socialite driver; for generic OAuth 2.0 use league/oauth2-client, and for enterprise identity use a maintained provider SDK. Consider jenssegers/oauth only for a legacy Laravel app or an OAuth 1.0a provider Socialite cannot cover. Even then, gate it behind a time-boxed spike and an internal adapter.
- Does jenssegers/oauth support PKCE, OpenID Connect, token refresh or revocation?
- The evaluated package does not indicate PKCE or OpenID Connect support, and its upstream is no longer actively developed. A refreshAccessToken() method exists in the consumed interface, but actual refresh and revocation behavior depends on the provider driver and must be tested. If you need OIDC, PKCE for mobile or native flows, or guaranteed revocation, this package is a poor fit. Choose a maintained alternative instead.
- How do I test jenssegers/oauth callback and token flows safely?
- Isolate the package behind an internal OAuth adapter so product code never imports it directly. Write integration tests for the callback, state mismatch, refresh, revocation and provider error paths, not just the happy-path redirect. Use a low-risk provider in a non-production environment first, and document a manual recovery path for login failures. Only broaden exposure after those tests pass.
- How do I migrate away from jenssegers/oauth?
- The consumed surface is small: OAuth::consumer(), getAuthorizationUri(), requestAccessToken(), request() and refreshAccessToken(). Wrap those calls behind an internal adapter, then replace the implementation with Laravel Socialite, league/oauth2-client or a maintained provider SDK. For a typical app this is usually a replacement measured in days, not weeks. Keep the adapter boundary so future swaps do not touch product code.