- How do I install oriceon/oauth-5-laravel in a Laravel 5 app?
- Install it with Composer using composer require oriceon/oauth-5-laravel, then register the package service provider in config/app.php and publish its configuration file with php artisan vendor:publish. The package targets Laravel 5.0 through 5.5 and PHP 5.6 or 7.x, so Composer may resolve legacy Guzzle 6 dependencies. After publishing, add client credentials for each provider and use the OAuth facade to start the flow.
- Which Laravel and PHP versions does oriceon/oauth-5-laravel support?
- It is built for Laravel 5 applications, typically 5.0 through 5.5, on PHP 5.6 and 7.x with legacy Guzzle 6. It does not have a maintained branch for Laravel 6 or newer, and dependency conflicts at the framework and Guzzle level will usually block installation on modern Laravel versions. Treat any use as a legacy or fork-and-own integration rather than a current dependency.
- How do I configure providers and client credentials in oriceon/oauth-5-laravel?
- After publishing the package config, define each provider with its client ID, client secret, redirect URI, and required scopes. The package maps a provider name to the matching League OAuth 1 or OAuth 2 client through a small factory, so configuration is array-driven rather than dependency-injected. Keep secrets out of version control and load them from environment variables.
- What do OAuth::consumer(), OAuth::request(), OAuth::authorize(), OAuth::getAccessToken() and OAuth::getResource() do?
- They expose the typical consumer flow: consumer() creates the provider client, request() obtains a temporary request token for OAuth 1, authorize() builds the authorization redirect, getAccessToken() exchanges a code or verifier for tokens, and getResource() calls a protected API endpoint. In practice you use these facade methods to glue the League client into controllers. Because it is a broad static facade, injection and mocking are awkward in tests.
- Can I use oriceon/oauth-5-laravel for social login with Facebook, Google, or Twitter?
- Yes, for legacy Laravel 5 apps that only need simple outbound OAuth consumer flows, it can handle social login and third-party API authorization. However, Laravel Socialite is the maintained first-party choice for social login and covers more providers with a larger maintainer base. Provider endpoints and scopes change over time, and this package's static provider list has not kept up.
- Does oriceon/oauth-5-laravel support OAuth 2.0 PKCE or OpenID Connect?
- No. It wraps older League OAuth client majors that predate widespread PKCE and OpenID Connect support, and the package itself adds no PKCE, OIDC, token introspection, or provider metadata discovery. Many providers now require PKCE for public clients, so this is a significant limitation. For modern OAuth 2.0 you should use a current league/oauth2-client provider directly.
- How should I store and refresh OAuth access tokens when using this package?
- The package handles the authorization exchange but does not provide a persistence layer, so your application must store access tokens, refresh tokens, and expiry data itself. Use encrypted database columns or a dedicated secrets store, scope tokens per user and tenant, and never put them in plain cookies or logs. Refresh handling must be implemented in your code or by the underlying League client, not by this wrapper.
- How do I test OAuth flows built with oriceon/oauth-5-laravel?
- The OAuth facade is a static convenience layer, so unit testing usually means mocking the facade or binding a fake consumer into the container. For end-to-end coverage, test your controller redirects and callback handling with stubbed HTTP responses rather than calling real providers. The package itself has little CI or test signal, so your own test suite must cover state validation, error paths, and token storage.
- Is oriceon/oauth-5-laravel maintained and safe for production?
- It is a fork of the long-abandoned artdarek/oauth-5-laravel with no recent releases, no visible CI, and effectively single-maintainer risk. It will not receive security patches, and it sits on end-of-life Laravel and PHP versions with older League client majors. For production, only consider it if you are prepared to fork it, review it, and own its maintenance.
- What are the best alternatives to oriceon/oauth-5-laravel for Laravel?
- For social login, Laravel Socialite is the first-party choice and works across supported Laravel versions. For third-party API access, use the current league/oauth2-client provider directly, ideally behind an application-owned provider registry that is dependency-injected and testable. On Laravel 6 or newer, those options are the correct path because this package will not resolve cleanly.