Oauthclient Laravel Package

Product Decisions This Supports

• Authentication feature for wiki-integrated products. Enables “Sign in with Wikipedia/MediaWiki” and lets users perform authenticated actions (edit pages, upload files, manage watchlists) on any wiki running the OAuth extension — Wikimedia projects included.
• Build vs. buy. Buying (or vendoring) this library replaces an in-house OAuth 1.0a signature implementation. It is a thin, purpose-built client from the Wikimedia organization, so it removes the most error-prone part of the flow (request signing, token exchange) rather than the whole integration.
• Roadmap inputs for community/editor tooling. Directly supports contribution dashboards, edit-a-thon trackers, GLAM/cultural-heritage upload tools, citation or cleanup bots with a human-in-the-loop, and moderated content-sync workflows where the wiki account is the identity.
• Identity model decisions. Forces an explicit decision on how wiki identities map to your own user accounts (link vs. primary identity vs. secondary credential) — a decision that is cheap now and expensive after launch.
• Scope triage. Signals that “wiki write access” is a discrete, bounded feature rather than a platform-level commitment; useful for sizing an MVP versus committing to Wikimedia as a first-class integration.

When to Consider This Package

Consider it when:

• Your backend is PHP (Laravel included) and you need to act as a MediaWiki OAuth consumer — that is, authenticate end users against a wiki rather than run a bot.
• The target wiki runs the OAuth extension (Wikimedia projects do; many private/enterprise MediaWiki installs do not).
• You are shipping an open-source or internal tool where GPL-3.0 is acceptable, and you are willing to pin or vendor the code.
• Your need is narrow and stable: login, token acquisition, signed API calls. The OAuth 1.0a surface has not changed, so a dormant library is a smaller problem here than it would be in a fast-moving protocol.
• You want a recognizable provenance (Wikimedia-maintained) to shorten security review of a small dependency.

Look elsewhere when:

• You need OAuth 2.0, which newer MediaWiki versions support and which is the better fit for modern SSO and token lifetimes. This library is OAuth 1.0a.
• You are building a closed-source commercial product — GPL-3.0 is a licensing conversation, not a footnote. Get counsel before adoption.
• You need active maintenance, an SLA, or a CVE response commitment. Last release was February 2019, 12 stars, zero dependents: assume no support and plan to own the code.
• You need multi-provider social login. A general OAuth client (e.g. league/oauth1-client or a Laravel socialite provider) with a custom MediaWiki provider gives you one integration pattern instead of two.
• You need high-volume or unattended editing. That is a bot-password / API-key problem, not an OAuth end-user problem.
• You are not on PHP, or you want a managed service to own the token lifecycle.

How to Pitch It (Stakeholders)

For executives: This is a small, free, Wikimedia-published PHP library that lets our product authenticate users against Wikipedia and other MediaWiki wikis and act on their behalf. It converts a fiddly cryptographic integration into roughly a day of wiring, and it makes “sign in with your wiki account” a credible near-term feature rather than a research spike. The trade-offs are that it is GPL-3.0 licensed, has not been released since 2019, and covers the older OAuth 1.0a standard — so it is best treated as a component we vendor and own, not a dependency we rely on someone else to maintain.

For engineering: It handles the OAuth 1.0a consumer flow against the MediaWiki OAuth extension — request token, redirect, callback verification, access token, signed API calls. Recommend wrapping it behind an internal WikiAuth interface so we can swap to MediaWiki’s OAuth 2.0 support or an in-house client without touching product code, pinning the version and vendoring the source, and validating it with a time-boxed spike against a real consumer registration before it lands on the roadmap. Assume we maintain it; budget accordingly and check the license with legal before commercial distribution.