Weave Code
Socialite Laravel Package
laravel/socialite
Laravel Socialite offers an expressive, fluent OAuth authentication interface for Laravel, supporting Bitbucket, Facebook, GitHub, GitLab, Google, LinkedIn, Slack, Twitch, and X while handling most social login boilerplate.
Laravel wrapper around OAuth 1 & OAuth 2 libraries.
Frequently asked questions about Socialite
- How do I install Laravel Socialite in a Laravel application?
- Install the package with Composer by running composer require laravel/socialite. Add your provider credentials to config/services.php and define the redirect and callback routes in your Laravel application. Use the Socialite facade or service container to start the OAuth flow and handle the returned user. Socialite does not impose database requirements, so map the user data to your existing models.
- Which OAuth providers does Laravel Socialite support?
- Core Socialite supports Bitbucket, Facebook, GitHub, GitLab, Google, LinkedIn, Slack, Twitch, and X. Adapters for other platforms are listed in the community-driven Socialite Providers ecosystem. The core package is not accepting new adapters, so check community support or custom integration for niche providers.
- Does Laravel Socialite support OAuth 1.0 and OAuth 2.0?
- Yes, Laravel Socialite wraps OAuth 1 and OAuth 2 libraries behind an expressive, provider-agnostic interface. Provider-specific behavior still matters, especially where a platform has moved between OAuth versions, such as X. Review the provider's current OAuth flow and Socialite configuration before relying on it in production.
- How do I configure Laravel Socialite credentials and callback routes?
- Add the client ID, client secret, and redirect URL for each provider in config/services.php, typically using environment variables. Register the redirect and callback routes in your Laravel routes and use the Socialite facade to drive the authentication flow. Keep secrets out of version control and make sure the callback URL exactly matches the value registered with the provider.
- How do I test Laravel Socialite without a real OAuth provider?
- Use Socialite's built-in fakes, such as FakeProvider, to simulate provider responses in unit and integration tests. This lets you assert user creation, callback handling, and session behavior without real OAuth credentials. Fakes are especially useful in CI/CD pipelines where external network calls should be avoided.
- Can I add an unsupported provider to Laravel Socialite?
- The core Socialite package no longer accepts new adapters, but you can extend AbstractProvider or use the Socialite Providers ecosystem for additional platforms. Custom integration is viable for niche providers, but budget time for provider-specific OAuth details and testing. Check whether a maintained community provider already exists before building your own.
- Does Laravel Socialite handle refresh tokens and token revocation?
- Socialite handles the OAuth authentication flow and returns access tokens, but it does not natively persist, refresh, or revoke tokens. You need to design your own token storage, rotation, and revocation logic if your application uses long-lived provider access. Plan this early because token lifecycle management adds long-term maintenance complexity.
- What Laravel, PHP, and Guzzle versions does Laravel Socialite support?
- Supported Laravel and PHP versions are defined by the package's Composer constraints, so check the require section on Packagist for the release you plan to use. As of v5.31.0, Socialite supports Guzzle 8, which helps applications on newer HTTP client versions. Align Guzzle major versions across your Composer dependency graph to avoid conflicts, and prefer a current Socialite release for supported Laravel versions.
- How does Laravel Socialite protect the OAuth state and CSRF flow?
- Socialite uses the OAuth state parameter and, in recent versions such as v5.26.1 and later, compares it with hash_equals for constant-time checking. CSRF protection relies on Laravel's middleware, so ensure your callback routes are properly protected. Using signed callback routes and auditing provider scopes further reduces security risk.
- Is Laravel Socialite suitable for production social login?
- For many Laravel applications, yes, provided you use a current release and follow security practices around state, CSRF, and callback routes. Socialite integrates with Laravel's middleware stack and uses constant-time state comparison in recent versions. You should still audit provider-specific scopes, token storage, and dependency versions for your production environment.
Weaver
How can I help you explore Laravel packages today?