Weave Code
Laravel Oauth2 Laravel Package
madewithlove/laravel-oauth2
An OAuth 2.0 authorization and resource server for Laravel, built on league/oauth2-server. It ships ready-made grant types, token repositories, middleware, and configuration to secure your API with access tokens, refresh tokens, and scopes.
Authorize users in your application with multiple OAuth 2.0 providers.
Frequently asked questions about Laravel Oauth2
- What is madewithlove/laravel-oauth2 used for?
- It is an OAuth 2.0 authorization and resource server package for Laravel, built on league/oauth2-server. It wires up standard endpoints, token repositories, middleware, and configuration so a Laravel application can issue access tokens to first- and third-party clients. It supports authorization code, password, client credentials, and refresh token grants with Eloquent-backed storage.
- Does madewithlove/laravel-oauth2 work with Laravel 10, 11, or 12?
- No. The package targets Laravel 4 and early Laravel 5 on PHP 5.x, and its last release was in December 2014. Its Composer constraints and league/oauth2-server integration will almost certainly conflict with modern PHP and Laravel versions. Treat it as a legacy reference rather than an installable dependency for Laravel 9, 10, 11, or 12.
- Which OAuth 2.0 grants are supported by laravel-oauth2?
- It supports authorization code, password, client credentials, and refresh token grants. These cover common cases such as third-party authorization-code clients, first-party password logins, server-to-server credentials, and token renewal. The package exposes the standard OAuth 2.0 endpoints through its League OAuth2 server integration.
- How do I install and configure madewithlove/laravel-oauth2?
- Historically you installed it with Composer, published its configuration and migrations, and configured clients, token repositories, and scopes through Laravel's container and config. You would then register the service provider and apply the package's route middleware to protected API endpoints. On a modern Laravel app this install path is not realistic because the package is archived and built on obsolete Laravel and League APIs.
- Is madewithlove/laravel-oauth2 maintained, and should I fork it?
- It is not maintained. The repository is archived, the last release was December 2014, and there have been no security patches, PHP 8 compatibility work, Laravel modernization, or dependency updates. Forking it means owning the package, its dependency tree, and its security posture indefinitely, and a modern Laravel integration would require a substantial rewrite rather than a small patch.
- What are the best alternatives to laravel-oauth2 for OAuth 2.0 in Laravel?
- For a full OAuth 2.0 authorization server in modern Laravel, use Laravel Passport. For first-party SPA or mobile token issuance where full OAuth 2.0 is not required, use Laravel Sanctum. For centralized identity, SSO, MFA, or enterprise client management, evaluate an external identity provider such as Keycloak, Auth0, or Okta.
- How does laravel-oauth2 store OAuth clients, access tokens, and scopes?
- The package uses Eloquent-backed storage for clients, access tokens, refresh tokens, scopes, and sessions. Token lifetimes and scope definitions are configurable, and the migrations create the database tables needed by the OAuth server. If you migrate away, that schema and config shape can serve as a behavioral reference for mapping existing clients and tokens.
- Can laravel-oauth2 protect API routes with middleware?
- Yes, in its intended Laravel 4 or early Laravel 5 stack, the package provides middleware and route helpers for protecting API endpoints with access tokens. However, its middleware registration and contracts predate modern Laravel and PSR-15-style middleware, so it is not a drop-in solution for current Laravel applications. Modern apps should use Passport, Sanctum, or equivalent middleware instead.
- Is laravel-oauth2 safe for production API authentication?
- No, it is high risk for new production use. The upstream is abandoned, the wrapped league/oauth2-server version is old, and OAuth 2.0 security best practices have moved on with stricter redirect URI validation, PKCE expectations, token binding, and revocation semantics. Without security patches or maintained documentation, it should only be kept for an existing legacy deployment with a clear migration plan.
- How can I test OAuth 2.0 flows if I inherit laravel-oauth2?
- If you inherit this package, test the existing authorization code, password, client credentials, and refresh flows against your current Laravel version before changing anything. Add regression tests for scope enforcement, token expiry, refresh rotation, and client validation, and capture the current config, routes, and database schema as migration references. For new work, test Passport, Sanctum, or your chosen identity provider against the same OAuth scenarios instead of building on this package.
Weaver
How can I help you explore Laravel packages today?