- Is majora/oauth-server-bundle a Laravel package?
- No. It is a Symfony bundle that ships a Bundle subclass, DI/container extension configuration, and Doctrine ORM mappings for clients, tokens and auth codes. There is no Laravel service provider, no publishable config file and no Eloquent layer, so it cannot be dropped into a Laravel app as-is.
- Can I install majora/oauth-server-bundle in a Laravel application?
- Composer will pull it in, but it expects the Symfony kernel, container extension model and Doctrine entity manager to be present. Making it work under Laravel means running two frameworks side by side or forking the bundle, at which point you own the code. For a Laravel app this is the wrong starting point.
- Which OAuth2 grant types does this bundle support?
- It supports the authorization code, client credentials, password and refresh token grants on top of league/oauth2-server. Device code flow and OpenID Connect are not part of the advertised feature set. Confirm your required grants, especially PKCE-protected authorization code, before scoping anything.
- Is majora/oauth-server-bundle still maintained?
- No, the repository is archived and read-only, which means no issue triage, no security response and no merged pull requests. Declared support starts at Symfony 2.8, a PHP 5.5 to 7.0 era, so expect breakage on PHP 8.x and Symfony 5, 6 or 7. For a component sitting on the authentication trust boundary, archiving is a disqualifier rather than a manageable risk.
- What is the difference between this OAuth2 server and an API guard like Sanctum?
- This bundle is an authorization server: it issues and validates OAuth2 tokens for clients and users. Sanctum and Passport guards are about authenticating requests to your own API. If your actual requirement is protecting Laravel routes, you need a guard, not a full OAuth2 server, and this package is the wrong category.
- What should I use in Laravel instead of this bundle?
- Use Laravel Passport if you genuinely need a first-party OAuth2 server with authorization code, client credentials and refresh tokens. Use Sanctum if simple API tokens are enough and full OAuth2 is overkill. If you need a spec-complete standalone identity provider, consider self-hosted options such as Keycloak or Ory Hydra instead of adopting an archived library.
- Does this bundle support PKCE, token revocation and refresh token rotation?
- The documented feature set covers grant handling, scopes, client storage and token lifetimes, but it does not call out PKCE, revocation endpoints or refresh token rotation with reuse detection. Those behaviours depend on the league/oauth2-server version wired in and on custom code you would have to write. Treat each one as an explicit acceptance criterion to verify before any adoption decision.
- Which Symfony and PHP versions does majora/oauth-server-bundle support?
- Declared support starts at Symfony 2.8, which corresponds to the PHP 5.5 to 7.0 era. Modern PHP 8.x and Symfony 5, 6 or 7 are outside that compatibility envelope and should be expected to break. This version drift alone makes it unsuitable for a new Laravel or modern Symfony build.
- How does client and token storage work in this bundle?
- Storage is configurable, with Doctrine ORM mappings provided for clients, access tokens, refresh tokens and authorization codes, plus the option of custom implementations. In a Laravel application you would have to reimplement all of that against Eloquent, including token hashing at rest and TTL defaults. That is a fork, not an integration.
- What should I check before depending on an archived OAuth library in production?
- Verify maintainer status and a security patch SLA first, because archived means you become the maintainer on day one. Then check token hashing at rest, refresh token rotation and reuse detection, state validation, auditability of issuance and revocation, and whether tokens are opaque or JWT given the hot-path database cost. Also check dependents and production evidence; this package has three stars and no dependents, so there is no community to inherit support from.