Franceconnect Laravel Package

Product Decisions This Supports

• France market entry and localization. FranceConnect is the French government's identity federation (the "log in with impots.gouv.fr / ameli.fr / La Poste" button). Adding it is a concrete, low-cost signal that the product is built for French users, not just translated for them.
• Signup and checkout conversion. Users who would otherwise abandon at a password form or an email-verification loop can authenticate in a few clicks with credentials they already have. This is a measurable funnel experiment: instrument completion rate for FranceConnect vs. email/password, by cohort.
• Identity assurance without becoming a KYC vendor. FranceConnect returns verified identity attributes (name, birth date, birth place, gender) at a substantial level of assurance. That powers decisions like: age gating, duplicate-account prevention, matching against existing records, reducing manual document upload in onboarding.
• Build vs. buy. This package is a thin, community-maintained Socialite driver over standard OIDC. It is not a vendor contract and not a differentiator — the decision to support FranceConnect is a product/compliance decision; the driver is a commodity implementation detail. Do not scope internal work to "build FranceConnect support"; adopt the driver.
• Fallback and exception-path design. Whether FranceConnect is required or offered alongside email/password is a real product decision: roughly a quarter of French adults are not FranceConnect-enabled, and expatriates and some user segments are poorly served. The package gives you the happy path; the product must own the fallback.
• Roadmap inputs it surfaces early: account linking/unlinking (existing email account → FranceConnect), single logout behavior, data-minimization choices about which scopes you actually request, and whether you will later need FranceConnect+ / France Identité for higher-assurance flows.
• Release 4.1.1 is a routine patch (4.1.0 → 4.1.1, no documented breaking changes, features, or deprecations). No product decision, migration, or roadmap change is triggered. Keep the ^4.1 constraint and let the lockfile govern.

When to Consider This Package

Good fit when:

• Your stack is Laravel with laravel/socialite already in use, and adding a provider is a config-plus-callback change rather than a new integration project.
• FranceConnect is one of several identity options, and you want it in days, not a quarter.
• You need authentication plus identity attributes only — no payments, no signature, no delegated API calls on the user's behalf.
• You have (or are actively pursuing) FranceConnect partner registration: this requires a legal entity, a signed agreement with the DGFiP, registered redirect URIs per environment, and adherence to the FranceConnect branding and consent-screen charter. The package does not remove any of this; it only removes the PHP OIDC plumbing. Treat partner onboarding as the critical path and engineering as a one-day task behind it.
• You accept community-maintained OSS: it lives in the SocialiteProviders monorepo, with a small maintainer pool and no commercial SLA.

Look elsewhere when:

• You need FranceConnect+ / France Identité with eIDAS high assurance, or identity-proofing guarantees a driver wrapper cannot provide — go to a certified identity broker or integrator.
• You need SAML, WS-Federation, or a non-Laravel service in the same auth flow.
• You require a vendor with contractual SLAs, security review artifacts, or indemnification — an OSS Socialite provider is not that, and you should not represent it as such to security or legal.
• You are not prepared to own the surrounding work: nonce/state handling, token and session lifetime, logout semantics, scope minimization, and the branding-compliant UI.
• You are on an unsupported Laravel/Socialite combination — the provider tracks the SocialiteProviders core major version, so check the version matrix before promising a date.

Version hygiene: pin to ^4.1, rely on the lockfile, and upgrade patch releases on your normal cadence. Because this is an OIDC wrapper, the real compatibility risk is FranceConnect-side endpoint and policy changes, not the package's patch releases — so assign an owner to monitor the FranceConnect partner announcements, not just the GitHub changelog.

How to Pitch It (Stakeholders)

For executives (one paragraph): FranceConnect is the French government's single sign-on, used across tax, health insurance, and postal services. Supporting it is table stakes for credibility with French users and typically improves signup completion by removing a password and email-verification step. We can do this with an existing open-source Laravel driver rather than a build project — the engineering cost is small and the package is free. The real work is administrative: becoming an approved FranceConnect partner requires a legal agreement, and that is the schedule driver, not code. Recommendation: approve a small spike now (one engineer, days) and start partner registration in parallel; the latest release (4.1.1) is a maintenance patch with no impact on scope, cost, or timeline.

For engineering (bullets):

• Scope: one Socialite driver plus configuration, a callback route, user mapping, and tests. No bespoke OIDC client, no crypto work.
• Own these explicitly: state/nonce validation, session fixation on login, account-linking policy for users whose email already exists, data minimization on requested scopes, and logout behavior.
• Environments: integration/sandbox and production use different endpoints and credentials; make them config-driven from day one. Do not hardcode.
• Dependency posture: community OSS, no SLA. Pin ^4.1, track patch releases automatically, and treat FranceConnect spec/endpoint changes as the primary upgrade risk. Wrap the provider behind a small internal auth adapter so a future swap to FranceConnect+ or a broker is a config change, not a rewrite.
• Not in scope: FranceConnect+ / eIDAS high assurance, identity document verification, delegated API access. If the roadmap needs those, that is a separate integration decision.