Weave Code
Kinde Auth Php Laravel Package
kinde-oss/kinde-auth-php
kinde-oss/kinde-auth-php is the official Kinde SDK for PHP, making it easy to add secure authentication to PHP apps. It supports OAuth/OIDC login, registration, logout, social and passwordless sign-in, and token handling with minimal setup.
Kinde Auth for PHP is a framework-agnostic SDK for adding Kinde authentication to PHP applications. It handles the OAuth 2.0/OpenID Connect authorization code flow with PKCE, callback processing, token exchange, and session-based token storage so you can secure routes and access user identity with minimal boilerplate.
- OAuth 2.0/OIDC login, registration, and logout flows
- PKCE-protected authorization code handling
- Token storage, refresh, and user profile retrieval
- Simple redirect and callback helpers for PHP apps
- Framework-agnostic integration with Laravel, Symfony, and more
Frequently asked questions about Kinde Auth Php
- Is kinde-oss/kinde-auth-php a Laravel package?
- No. It is a framework-agnostic PHP SDK for Kinde, not a Laravel-native package. You can use it inside Laravel, but you must build a custom guard or middleware, callback routes, and user mapping. It is not a drop-in replacement for Laravel Breeze, Jetstream, Sanctum, or Socialite.
- How do I install and configure Kinde Auth in Laravel?
- Install it with Composer using composer require kinde-oss/kinde-auth-php. Then add Kinde configuration such as domain, client ID, client secret, and redirect URI, register login/callback/logout routes, and wrap SDK calls in a dedicated service or adapter. Expect to write the Laravel guard and middleware yourself because the SDK does not ship Laravel service providers.
- Which Laravel and PHP versions does the Kinde PHP SDK support?
- The provided context does not specify supported Laravel or PHP versions, so verify composer.json constraints and release notes before adopting. Test against your app's PHP version, session driver, cache, queue, cookie/domain settings, and reverse proxy setup. Laravel version support depends largely on the adapter you build around the SDK.
- Does the SDK handle OAuth2/OIDC login, PKCE, state, and nonce?
- The SDK is described as handling OAuth2/OIDC login, registration, logout, token validation, and user retrieval. Before production, confirm in the source that authorization-code-with-PKCE, state, nonce, JWKS validation, and refresh are implemented correctly. You still own the Laravel callback handling and session integration.
- How do I validate Kinde ID and access tokens in Laravel?
- Use the SDK and JWKS to verify signature, issuer, audience, and expiry instead of ad-hoc string checks. Cache JWKS and avoid per-request calls to Kinde APIs. Add middleware that rejects invalid tokens and maps validated claims to a local user record.
- Can I use Kinde Auth with Laravel Sanctum or existing guards?
- You can run Kinde alongside Laravel's existing auth, but decide whether Kinde tokens replace or supplement Sanctum tokens. A practical pattern is a custom guard for browser sessions and a separate API token strategy. Keep Laravel's session, CSRF, and authorization patterns intact where possible.
- How do I map Kinde users, organizations, and roles to Laravel?
- Create an external-identity mapping table that links Kinde subject IDs to local user IDs so roles, audit logs, and application data remain stable. Map Kinde organizations, roles, and permissions into Laravel gates and policies. Just-in-time provisioning reduces migration friction, but reconcile periodically because webhook sync drift is a risk.
- Does the Kinde PHP SDK support logout and token refresh?
- The SDK is described as handling logout and token validation, but confirm refresh-token support in the exact release you install. Logout should clear the Laravel session and redirect through Kinde's logout endpoint. Test session fixation and CSRF behavior during your proof of concept.
- Is kinde-oss/kinde-auth-php production-ready and well maintained?
- Treat it as a vendor integration layer rather than a proven Laravel package. The assessment cites 22 GitHub stars, an unknown repository URL, and an anomalous last-release date that must be verified. MIT licensing is favorable, but low adoption means fewer Laravel examples, possible undocumented edge cases, and a need for your own security review.
- What are alternatives to Kinde Auth for Laravel, and how should I migrate?
- Alternatives include Laravel Socialite, Sanctum, Breeze or Jetstream, or integrating another OIDC provider directly. Migrate incrementally by piloting one route group, running Kinde in parallel with existing auth, and preserving local user IDs through an external-identity table. Avoid a big-bang auth replacement, and move cohorts through invitation or just-in-time provisioning.
Weaver
How can I help you explore Laravel packages today?