Weave Code
Oauth Server Bundle Laravel Package
mapado/oauth-server-bundle
Mapado OAuthServerBundle integrates an OAuth2 authorization server into Symfony applications, providing endpoints, storage entities, grant handlers, and security integration for issuing, refreshing, and validating access tokens.
A server side OAuth2 Bundle for Symfony
Frequently asked questions about Oauth Server Bundle
- Does mapado/oauth-server-bundle work with Laravel?
- No. It is a Symfony bundle built on Symfony's kernel, service container, routing loader, security firewall, event dispatcher, and Doctrine ORM mappings, none of which Laravel exposes as extension points. A Laravel application cannot register its routes, services, or token guards without effectively reimplementing the bundle. Treat it as incompatible with Laravel rather than something that needs a small adapter.
- How do I install and register mapado/oauth-server-bundle?
- Installation is via Composer, but registration is Symfony-specific: you enable the bundle in your Symfony kernel or bundles.php and configure it under config/packages. There is no Laravel service provider, facade, or config file, so composer require alone will not produce working OAuth2 endpoints in a Laravel application. In Symfony the bundle then wires the OAuth2 server library into the container and security layer.
- Which Laravel versions does mapado/oauth-server-bundle support?
- None. The package targets Symfony and does not declare Laravel framework support; its dependencies are Symfony components, Doctrine, and the OAuth2 server library. Version constraints in composer.json refer to Symfony and PHP, not Illuminate packages. For Laravel version support you need a Laravel-native package such as Passport.
- What should I use instead of mapado/oauth-server-bundle in Laravel?
- Use Laravel Passport if you need a full OAuth2 authorization server with authorization code, password, client credentials, and refresh grants. Use Laravel Sanctum for first-party SPA or mobile API tokens where full OAuth2 is overkill. If you need non-Eloquent storage or custom grants, use league/oauth2-server directly, which is the maintained successor to the library lineage this bundle depends on.
- Is mapado/oauth-server-bundle maintained or safe for production?
- The repository is a fork of the retired FOSOAuthServerBundle and sits on the end-of-life bshaffer/oauth2-server-php lineage, with no published changelog or diff audit relative to upstream. It has zero stars and zero dependents, which means little external review, few incidental bug reports, and no community pressure to patch. For an authorization server, that is a supply-chain and security risk: OAuth2 defects are token leakage, scope escalation, and redirect-URI validation gaps, and an unmaintained fork has no CVE response path.
- What grant types does mapado/oauth-server-bundle support?
- It supports the standard OAuth2 grants exposed by the underlying server library: authorization code, password, client credentials, and refresh token. Scopes and token lifetimes are configurable, and services and events are extensible for custom flows. Those capabilities are real, but they are delivered through Symfony DI and security integration, not Laravel's guard system.
- Is mapado/oauth-server-bundle a fork of FOSOAuthServerBundle?
- Yes. The Composer package resolves to mapado/FOSOAuthServerBundle, a fork of the long-deprecated FriendsOfSymfony bundle. What Mapado changed relative to upstream is not documented from the outside; there is no changelog, diff audit, or compatibility matrix. That makes it hard to assess patch level or security posture before adoption.
- Can I use mapado/oauth-server-bundle with Laravel's Eloquent or Doctrine?
- The bundle is built around Doctrine ORM mappings for clients, access tokens, and refresh tokens. Laravel typically uses Eloquent, and while Doctrine can be added to Laravel, that does not give you the bundle's Symfony container, firewall, or routing integration. Storage compatibility alone is not enough to make the authorization server work in a Laravel app.
- How much effort is it to integrate mapado/oauth-server-bundle into a Laravel API?
- It is not feasible as scoped. Reimplementing the Symfony container, routing, and security firewall integration is effectively the whole package, and the effort would exceed building directly on league/oauth2-server. A one-day spike is reasonable only if its required output is a documented 'confirmed incompatible' finding. Do not fund an adapter workstream.
- How does mapado/oauth-server-bundle compare to Laravel Passport and league/oauth2-server?
- Passport is Laravel's first-party OAuth2 server and wraps league/oauth2-server, so it gives you maintained code, framework-native guards, and an upgrade path. league/oauth2-server is the maintained library successor to the EOL lineage this bundle relies on, and league/oauth2-server-bundle is its Symfony counterpart. mapado/oauth-server-bundle is a fork of a fork with no adoption signal, so Passport or the league packages win on maintenance, security response, and Laravel fit.
Weaver
How can I help you explore Laravel packages today?