- How do I install overtrue/socialite with Composer?
- Install it with Composer using composer require overtrue/socialite. The package requires PHP 8.0.2 or newer, so confirm your runtime before adding it. Then define provider credentials such as client_id, client_secret, and redirect_uri in your configuration.
- Does overtrue/socialite work with Laravel, and can I use it without Laravel?
- Yes, the core package is framework-agnostic but works in Laravel, and the overtrue/laravel-socialite wrapper provides a more convenient integration. You can also use it without Laravel in plain PHP, Slim, Symfony, or PSR-15 middleware stacks. Laravel version compatibility depends on the wrapper and your PHP version, so check those constraints.
- What PHP version does overtrue/socialite require?
- overtrue/socialite requires PHP 8.0.2 or higher. This requirement applies to the core package, so older PHP 7.x applications cannot use current releases. Confirm your Composer platform config and deployment runtime meet it.
- Which OAuth providers does overtrue/socialite support?
- It supports 20+ OAuth2 platforms, including GitHub, Google, Facebook, Apple, Twitter, WeChat, Weibo, QQ, Douyin, and Alipay. Chinese platforms such as WeChat, DingTalk, Feishu, and Tencent Cloud are also covered. Provider-specific configuration still needs to match each platform’s OAuth documentation.
- How do I create a custom OAuth provider in overtrue/socialite?
- Implement the ProviderInterface and wire your class into the SocialiteManager’s provider resolution. This lets you add internal SSO, legacy systems, or niche platforms without forking the package. Validate your implementation against the same redirect and code-exchange flow used by built-in providers.
- What is the difference between overtrue/socialite and laravel/socialite?
- laravel/socialite is built for Laravel, while overtrue/socialite is inspired by it and designed for any PHP project. That makes overtrue a better fit for framework-agnostic services, microservices, or legacy PHP apps. Laravel teams can still use the overtrue/laravel-socialite wrapper for a familiar integration.
- How do I store OAuth access tokens with overtrue/socialite?
- The package does not persist OAuth tokens for you; it returns access tokens and profile data after the code exchange. You should store tokens securely in a database, Redis, or another encrypted store and handle expiration or revocation. You can inject custom persistence through TokenRepositoryInterface where needed.
- Why does overtrue/socialite 4.15 require Guzzle 8 and how do I fix Composer conflicts?
- Version 4.15.0 requires guzzlehttp/guzzle ^8.1, so Composer cannot resolve it alongside dependencies pinned to Guzzle 7.x. Run composer why guzzlehttp/guzzle and composer update --dry-run in a branch to audit the transitive tree. If sibling SDKs still need Guzzle 7, either coordinate a full upgrade or stay on 4.14.x.
- How can I test overtrue/socialite OAuth flows without hitting real providers?
- The package does not ship a dedicated OAuth fake, but you can inject a PSR-18-compatible test client through withHttpClient() and stub token/profile responses. Test the redirect URL generation and callback code exchange separately, and avoid calling real providers in CI. This keeps OAuth flow tests fast and deterministic.
- Is overtrue/socialite suitable for production, and how do I secure OAuth login?
- Yes, it is suitable for production when you configure providers correctly, use HTTPS redirect URIs, and store tokens securely. Pay attention to provider-specific quirks such as WeChat component mode or Alipay RSA2 settings. Also audit the Guzzle 8 dependency change and keep the package updated within a tested version range.