- How do I install league/oauth2-github?
- Install it with Composer using league/oauth2-github, then instantiate the GitHub provider with your OAuth App client ID, client secret, and callback URL. The package is an adapter for the League OAuth2 Client, so you still use that client stack for the authorization-code flow and token exchange. In Laravel, wrap it behind a service rather than using it directly throughout your app. Validate PHP, Composer, and League OAuth2 Client version constraints before adopting it.
- Does league/oauth2-github work with Laravel?
- It is not a Laravel-native package and provides no service provider, facade, or Laravel-specific configuration. You can use it inside a Laravel app through the League OAuth2 Client, but Laravel Socialite's GitHub driver is the default fit and requires less custom authentication code. For new Laravel work, Socialite is generally the better choice. Use this package only when your application already depends on the League OAuth2 Client stack.
- Is league/oauth2-github compatible with PHP 8 and Composer 2?
- The last release was in January 2017, which predates modern PHP and Composer norms, so PHP 8 and Composer 2 compatibility should not be assumed. Run a time-boxed spike with your exact PHP version, Composer version, and League OAuth2 Client major version. Check composer why and the lockfile for conflicts, then pin versions if the spike succeeds. If compatibility fails, use Socialite or a maintained replacement.
- What GitHub scopes do I need for login and email with league/oauth2-github?
- Most GitHub login flows request read:user and user:email scopes. The email address can still be missing or private depending on the user's GitHub settings, so your code must handle a null or unavailable email gracefully. Request only the scopes your application genuinely needs. Test consent denial and missing-email paths before relying on this package in production.
- What is league/oauth2-github used for?
- It adds GitHub-specific authorization and token handling to the League OAuth2 Client for GitHub.com OAuth 2.0 workflows. Developers use it to implement GitHub login and retrieve basic user profile data through a standard authorization-code flow. It is a narrow provider adapter, not a complete Laravel authentication solution. It fits best in custom PHP services already using the League OAuth2 Client.
- Is league/oauth2-github actively maintained?
- The last release was 2017-01-26, and there is no recent maintenance or security-patching signal. Treat it as unmaintained unless you verify otherwise, and budget for Composer audits, API/scope monitoring, and a fork plan. The MIT license permits forking, but it does not provide free maintenance. For long-lived authentication, an unmaintained dependency is a significant risk.
- Should I use league/oauth2-github or Laravel Socialite?
- For Laravel applications, Laravel Socialite is usually the better fit because it reduces custom authentication code and is designed for the framework. This package overlaps heavily with Socialite's GitHub driver and adds little product value in a typical Laravel app. Choose league/oauth2-github only when you are already committed to the League OAuth2 Client stack or are working outside Laravel. Otherwise, use Socialite or a maintained provider implementation.
- How do I test GitHub OAuth with league/oauth2-github?
- Use a dedicated GitHub OAuth App for staging, a valid callback URL, and test credentials that are not used in production. Mock or fake GitHub HTTP responses where possible, and explicitly test consent denial, state mismatch, missing email, and revoked token paths. Automate the authentication tests so regressions are caught before deployment. Also verify behavior when GitHub is unavailable or rate limits are hit.
- Does league/oauth2-github support GitHub Enterprise?
- The package is primarily a GitHub.com OAuth 2.0 provider, and GitHub Enterprise endpoint configurability must be validated for your version. Check whether the authorization, token, and API base URLs can be overridden cleanly before committing to it. Test against your Enterprise instance in staging, including scopes and user profile responses. If Enterprise endpoints are not supported, use a maintained custom provider instead.
- What are the production risks of using league/oauth2-github?
- The main risks are that it is an unmaintained authentication dependency, may have stale assumptions about GitHub API responses or scopes, and may conflict with current PHP or League OAuth2 Client versions. Missing email permissions, token revocation, GitHub outages, and rate limits also need explicit handling. Wrap the provider behind an internal interface and feature-flag a replacement such as Socialite. Monitor login success and error rates, and define an exit plan before relying on it long term.