- Is oro/oauth2-server a Laravel package?
- No. oro/oauth2-server is a framework-agnostic OAuth 2.0 authorization and resource server library from the OroPlatform ecosystem, forked from the bshaffer/oauth2-server-php lineage. It does not ship Laravel service providers, facades, publishable config, or Eloquent models. In Laravel you must write the controllers, middleware, and storage adapters yourself.
- How do I install oro/oauth2-server in a Laravel application?
- Install it with Composer, but treat it as a low-level library rather than a Laravel integration. You will need to implement storage interfaces for clients, access tokens, refresh tokens, authorization codes, and scopes against Eloquent or a cache. You must also adapt Illuminate HTTP requests into the library's request and response objects and wire grant endpoints into your routes. Expect to pin PHP and PSR dependency versions yourself.
- What OAuth 2.0 grant types does oro/oauth2-server support?
- The package covers common OAuth 2.0 grants, including authorization code and client credentials, and it handles access and refresh token issuance, validation, and revocation. Scope-based permissions are supported for fine-grained API access control. Modern flows such as PKCE should be verified rather than assumed, because this fork follows an older bshaffer lineage.
- Does oro/oauth2-server support PKCE, OpenID Connect, or token introspection?
- Do not assume support. The documented feature set focuses on authorization code, client credentials, scopes, and token lifecycle management, while PKCE, OIDC, and token introspection need verification or backporting. If OIDC or introspection is in scope now or within 12 months, this package is likely a poor fit.
- How does oro/oauth2-server compare with Laravel Passport?
- Laravel Passport is built on league/oauth2-server and provides migrations, guards, middleware, Artisan commands, PKCE, and an actively maintained upstream. oro/oauth2-server is the raw primitive layer and would require you to reimplement most of what Passport gives you for free. Choose oro/oauth2-server only for a specific constraint such as an existing bshaffer-lineage deployment, OroPlatform interoperability, or a hard requirement against League.
- How do I configure client and token storage in oro/oauth2-server?
- The package exposes configurable client and token storage integration points rather than Laravel-native models. You implement the storage interfaces against Eloquent, Doctrine, Redis, or another backend and supply your own caching layer for token lookups. Plan for key management, revocation handling, and scope enforcement outside the library.
- Which PHP and Laravel versions are supported by oro/oauth2-server?
- Check composer.json before committing. This is an OroPlatform-oriented fork, so expect constraints for PHP, illuminate dependencies, and PSR interfaces to be absent or not aligned with your Laravel version. You will likely need to pin PHP 8.1, 8.2, or 8.3 compatibility and PSR interface versions yourself. Verify whether storage adapters assume Doctrine.
- How should I test oro/oauth2-server OAuth2 flows in Laravel?
- Build a conformance test suite around the flows you actually need: authorization code, client credentials, scope enforcement, refresh-token rotation, revocation, and redirect URI validation. Add integration tests that exercise your storage adapters and the request bridge into the library, because that abstraction mismatch is a common source of subtle bugs. Include negative tests for token entropy, replay detection, and invalid scopes.
- Is oro/oauth2-server actively maintained and safe for production?
- Treat it as high risk unless you verify otherwise. The repository has very low adoption, no external bug reporter pool, and a fork that may be a frozen mirror or carry OroPlatform-specific patches. OAuth2 is security-critical, so redirect URI validation, token entropy, PKCE, refresh-token replay detection, and signing-key management must be reviewed against current guidance. Have a fork-and-vendor strategy and a CVE disclosure process.
- Can I migrate from bshaffer/oauth2-server-php or Laravel Passport to oro/oauth2-server?
- From bshaffer/oauth2-server-php, migration may be close to a drop-in if the APIs match, but gate it with a security-patch and conformance test suite. From Laravel Passport, expect a rewrite of token issuance, guards, scope middleware, revocation, and key handling while preserving database schema where possible. Greenfield Laravel projects should not start here.