Weave Code
Laravelpassport Laravel Package
socialiteproviders/laravelpassport
Laravel Passport OAuth provider for Laravel Socialite. Adds a passport driver so your app can authenticate users against any Laravel Passport server using standard OAuth2 flows, with minimal setup and familiar Socialite syntax.
Socialite Passport is a Laravel Socialite provider that lets applications authenticate users through a Laravel Passport OAuth2 server. It plugs into the existing Socialite flow, so you can add a Passport-backed login option alongside other providers with minimal configuration.
- Adds a
laravelpassportSocialite driver with configurable host, client ID, secret, and scopes - Supports refresh tokens and custom authorization/token endpoints
- Exposes the raw token response alongside standard Socialite user data
- Integrates with Laravel's Socialite event listener for driver registration
- Installs via Composer and documented for quick setup
Frequently asked questions about Laravelpassport
- How do I install socialiteproviders/laravelpassport in a Laravel app?
- Install it with Composer alongside laravel/socialite: composer require socialiteproviders/laravelpassport. The package is a subtree split of the SocialiteProviders/Laravel-Passport provider, so it plugs into the SocialiteProviders manager rather than shipping its own service provider architecture. After installing, register the SocialiteProviders listener so the passport driver is added to Socialite, then add a passport block to config/services.php. Pin the exact package version in composer.json, since the last tagged release is from August 2022.
- How do I configure the Laravel Passport driver in config/services.php?
- Add a passport entry with client_id, client_secret, and redirect, plus the base URL of the Passport server you are authenticating against. The client credentials come from an OAuth client registered on that Passport server, and the redirect URI must match exactly what is registered there. You can request additional scopes on the provider instance in your controller if your Passport server exposes them. Keep these values in environment variables rather than committing secrets.
- Which Laravel, Socialite, and PHP versions does this provider support?
- Compatibility is the main risk with this package: the last tagged release is August 2022, and Socialite's AbstractProvider contract has moved since then. Verify the provider satisfies the contract on the Socialite major your app is pinned to before committing, and explicitly test PHP 8.2 and 8.3 with Laravel 10 and 11. Signature drift on methods like getAuthUrl and getUserByToken typically surfaces at install or first login, not during code review. If it fails, budget for a fork behind an internal namespace rather than blocking on upstream.
- What does the provider expect from my Passport server's /user endpoint?
- The provider assumes a particular user payload shape when it parses the response from the Passport server's user endpoint, and a Passport server you control will not match it by default. You own the mapping between the raw payload and the Socialite user object, so agree on a contract covering id, name, email, and avatar with the server owners. If the identity server does not expose a user endpoint the provider can parse, this package is the wrong tool. Decide up front which claims and scopes are required, such as email verification, roles, or tenant identifiers.
- How do I add the redirect and callback routes for the Passport driver in Laravel?
- Add two routes pointing at a small controller: one that calls Socialite::driver('passport')->redirect() and one that calls ->user() on the callback. The redirect route sends the user to the Passport server's authorization endpoint, and the callback route receives the authorization code and performs the token exchange. Register the callback URL as the redirect URI on the Passport client, including for staging environments. A feature flag with dual login entry points is useful if you are migrating from another SSO.
- Does this package support PKCE for public clients?
- No. The provider assumes a confidential client with a client secret, which is the standard authorization-code flow for a server-side Laravel application. There is no PKCE support, so it is not suitable for mobile apps, SPAs, or other clients that cannot keep a secret. If you need PKCE, you will need a different OAuth2 client rather than this adapter.
- Can I get refresh tokens or call the Passport server's API after login?
- Not through this package. Socialite is login-time only, so the provider handles the authorization redirect, callback, and token exchange but does no refresh-token handling. If you need to call the Passport server's APIs afterward, that token lifecycle is yours to build, including storage and refresh. The access token returned in the Socialite user object is the starting point, not a managed credential.
- Is socialiteproviders/laravelpassport actively maintained and safe to use in production?
- Treat it as community-maintained with no SLA: it lives under the SocialiteProviders org and the last tagged release was August 2022. Adoption signal is thin, with roughly 62 stars and no recorded Packagist dependents, so there is little evidence of production use. It is a thin adapter with a small surface area, which limits risk, but you should be prepared to vendor or fork it behind an internal namespace. Confirm the license and org governance clear your supply-chain policy before adopting.
- How is this different from a generic OIDC client or using Passport directly?
- This is not a general OAuth2 or OIDC client. It has no discovery document, no JWKS, and no id_token validation, and it only understands a Passport-shaped server. Its advantage is architectural fit: it reuses the Socialite facade, user provider, and guard wiring you already have, and lets an existing Passport installation double as your SSO authority instead of standing up a second identity system. If your identity provider is not Passport, a generic OIDC client is the better choice.
- How should I test the Laravel Passport Socialite integration before shipping?
- Add a CI smoke test that runs the full authorization-code exchange against a staging Passport instance, because unit tests will not catch signature drift in Socialite's provider contract. Keep the legacy login path live behind a feature flag until a complete cycle has succeeded in production for real users, including edge cases like expired codes and revoked clients. Register a staging client and redirect URI early so the test can run before your application code is finished. Pin exact versions of the provider, laravel/socialite, and the Passport server so upgrades are deliberate.
Weaver
How can I help you explore Laravel packages today?