- How do I install league/oauth2-server in a Laravel app?
- Install with composer require league/oauth2-server, but in Laravel most teams should install Laravel Passport instead because it supplies the integration layer. Direct use means you provide PSR-7 bridging, repository interfaces, entities, routes, middleware, and key management yourself. The package requires PHP 8.2 to 8.5 plus the openssl and json extensions.
- Does league/oauth2-server work with Laravel 11 and Laravel 12?
- Yes, but not as a drop-in Laravel package. It is framework-agnostic and has no Laravel service provider, routes, migrations, or Eloquent models; Laravel Passport supplies those around it. On Laravel 11 or 12 with PHP 8.2 to 8.5, use Passport for standard flows or budget custom glue for direct integration.
- Should I use league/oauth2-server or Laravel Passport?
- Laravel Passport is the correct integration surface for most Laravel applications because it wraps league/oauth2-server with client and token models, migrations, guards, routes, and key commands. Use league/oauth2-server directly only when you need custom grants, non-Eloquent storage, or constraints Passport cannot meet. Direct adoption is a build project, not a single Composer require.
- Which OAuth 2.0 grants does league/oauth2-server support?
- It supports authorization code, client credentials, device authorization, implicit, refresh token, and resource owner password credentials grants. The README also lists RFC6749, RFC6750 bearer tokens, RFC7519 JWT, RFC7636 PKCE, and RFC8628 device flow. Implicit and password grants exist for compatibility but should be avoided for new public clients where authorization code with PKCE is possible.
- Is league/oauth2-server secure by default?
- Secure by default is not a substitute for explicit configuration. You must enforce redirect URI matching, PKCE for public clients, refresh token rotation, scope finalization, token TTLs, key permissions, and client confidentiality as acceptance criteria. Pin at least 9.2.0 if device flow is in scope and 9.3.0 if PHP 8.5 or stricter log hygiene matters.
- How do I implement the OAuth 2.0 device authorization grant in Laravel?
- The package implements RFC8628 device authorization, but Laravel Passport may not expose the full device flow UI and verification endpoint you need. Pin at least 9.2.0 because 9.1 to 9.3 fixed device-flow scope handling, slow_down persistence, and event emission. Expect to build device code verification, user approval, polling behavior, and client administration yourself if you integrate directly.
- What PHP versions and extensions does league/oauth2-server require?
- The 9.x line supports PHP 8.2, 8.3, 8.4, and 8.5 and requires the openssl and json extensions. All HTTP messages passed to the server should be PSR-7 compliant. Applications on PHP 8.1 must either remain on the 8.x package line or complete a PHP and Laravel upgrade before adopting 9.x.
- Can I use league/oauth2-server for OpenID Connect or social login?
- No. league/oauth2-server is an OAuth 2.0 authorization server, not an OpenID Connect provider, so it does not provide ID tokens, userinfo, consent UI, social login, or a full identity platform. If you need OIDC or SSO, evaluate a dedicated OIDC provider or add that layer separately. Social login is usually handled by Laravel Socialite, not this package.
- How do I test a league/oauth2-server integration?
- Test your repositories and entities in isolation, then feature test the token endpoint with PSR-7 requests and assert grant behavior, PKCE enforcement, refresh rotation, error codes, and redirect URI matching. Regression test custom code against 9.0 changes such as strict typing, string-cast request parameters, factory-created authorization requests, mandatory access token toString, and removed error message property. Include negative security tests for bearer header case sensitivity and stack-trace leakage.
- What are the production risks and maintenance concerns for league/oauth2-server?
- The project is active, MIT licensed, has about 6.7k stars, a changelog, and a Mozilla-funded security audit, but maintainer concentration and no commercial SLA remain real risks. Major 9.x changes have broken custom entities, repositories, and error handling, so pin 9.2.0 or 9.3.0 and run regression tests. Direct integration also leaves you owning token cleanup jobs, key management, schema design, and client administration. MIT makes fork or escrow feasible, but it is not free support.