Weave Code
Zalo Laravel Package
socialiteproviders/zalo
Zalo OAuth provider for Laravel Socialite, letting you add Zalo login to your app with a simple driver. Install via Composer, configure your app ID and secret, then authenticate users through Zalo’s OAuth flow alongside other Socialite providers.
SocialiteProviders/Zalo adds Zalo authentication to Laravel's Socialite package. It lets you authenticate users through Zalo's OAuth flow and retrieve their profile, so you can integrate Vietnamese Zalo login into any Laravel app.
- OAuth-based Zalo login for Laravel Socialite
- Drop-in event listener registration via SocialiteProviders
- Configurable client ID, secret, and redirect URI
- Returns user profile data (ID, name, avatar)
- Standard Socialite driver API for minimal code changes
Frequently asked questions about Zalo
- How do I install socialiteproviders/zalo in a Laravel app?
- Install it with Composer using composer require socialiteproviders/zalo. Then make sure the SocialiteProviders manager service provider is registered and the ZaloExtendSocialite listener runs, which newer Laravel versions usually handle through event discovery. Finally add a zalo block with your client_id, client_secret and redirect URI to config/services.php.
- What Laravel and laravel/socialite versions does this Zalo provider require?
- The package is a Socialite driver extension, so it tracks laravel/socialite majors closely, and version 5.0.0 is a major bump from 4.1.0. The 5.0.0 release notes contain only a diff link with no stated minimum PHP, Laravel or Socialite versions, so check composer.json in the compare/4.1.0...5.0.0 diff before committing. If 5.0.0 requires a newer Socialite major, that can transitively constrain or force an upgrade of your host app's Laravel version.
- How do I configure Zalo OAuth credentials in config/services.php?
- Add a zalo entry containing client_id, client_secret and redirect, matching the credentials from your Zalo developer application. Keep the actual values in environment variables or a secrets manager and reference them with env() so nothing sensitive is committed to the repository. The redirect value must exactly match a URI allowed in your Zalo app configuration.
- What routes and controller code do I need for Zalo login?
- You need a redirect route that returns Socialite::driver('zalo')->redirect() and a callback route that calls Socialite::driver('zalo')->user() to retrieve the authenticated Zalo user. The callback route must be registered in your Zalo app's redirect URI allowlist or Zalo will reject the authorization request. From there you log the user in with Auth::login() or create the account, exactly as with any other Socialite driver.
- What changed between socialiteproviders/zalo 4.1.0 and 5.0.0?
- The published 5.0.0 notes only link to the compare/4.1.0...5.0.0 diff, with no changelog body, migration guide or listed breaking changes. Because a major bump is an explicit semver signal, read the diff before adopting it, since likely candidates include minimum PHP, Laravel or Socialite bumps, renamed configuration keys, or adaptation to a Zalo Open API change. Until then, treat 4.1.0 as a valid fallback if it still works against Zalo for your app.
- Does this package let me send Zalo ZNS messages or manage an Official Account?
- No. It is strictly an OAuth2 identity provider for Laravel Socialite, covering the login flow and a limited user profile mapping. Sending ZNS messages, managing OA followers, ZaloPay or other Zalo APIs require a separate integration. Do not let stakeholders conflate Zalo login with the broader Zalo platform SDK.
- Which Zalo scopes does the provider request, and can I customize them?
- The provider requests a default set of scopes for basic profile access, and Socialite lets you pass additional scopes via Socialite::driver('zalo')->scopes([...])->redirect() or set them with setScopes(). Check the provider source and the Zalo developer console, since Zalo only returns data for scopes it has approved for your app. If you need permissions beyond login and basic profile, verify them with Zalo before relying on them.
- Can I use this provider for a SPA or mobile app token exchange instead of a web redirect flow?
- The provider is designed for the conventional web-session flow of redirect, callback and Socialite::driver('zalo')->user(). It is not built as an API-to-API auth library or a pure token-exchange client for SPAs and native apps. For those architectures you would need a backend-for-frontend that performs the redirect and callback, then issues your own tokens to the client.
- Is socialiteproviders/zalo safe and reliable for production use?
- It is a community-maintained SocialiteProviders driver with a single maintainer and no vendor SLA, so long-term availability and response time to Zalo API changes are not guaranteed. Mitigation is cheap because the provider is a thin class that can be vendored or reimplemented in-house if it is abandoned. On the security side, store the client secret and tokens in environment variables, validate OAuth state, and rate-limit the callback route.
- Is there anything to check about data residency before enabling Zalo login?
- Zalo is a Vietnamese platform, so user profile data flows through Zalo's API, which is normally fine for products serving Vietnamese users. Confirm this against your organization's data-handling policy before enabling it in production, particularly for regulated or sensitive data. Also confirm which profile fields the provider maps, since the package only exposes a limited subset of Zalo user data.
Weaver
How can I help you explore Laravel packages today?