- Is spawnrad/oauth-bundle actually a Laravel package?
- The package is marketed as a Laravel OAuth 2.0 bundle, but its repository is a fork of HWIOAuthBundle, which is a Symfony bundle. There is no Illuminate service provider, package-discovery entry, publishable config/oauth.php, or facade in the codebase. Treat it as a Symfony component with Laravel-oriented documentation rather than a native Laravel package.
- How do I install spawnrad/oauth-bundle in a Laravel application?
- You would add it with composer require spawnrad/oauth-bundle, but expect Composer to resolve Symfony components alongside Laravel's own pinned versions. There is no documented Laravel installation flow, no auto-discovery, and no config publishing step, so setup is not a standard Laravel experience. Test the install in a throwaway branch before touching a real application.
- Which Laravel and PHP versions does spawnrad/oauth-bundle support?
- The repository does not publish a PHP or Laravel version constraint matrix, CI results, or compatibility statement. Because it is a Symfony bundle fork, its implicit target is the Symfony version it was branched from, not a specific Laravel release. Assume Laravel 10 and 11 are unverified unless you confirm them yourself.
- Will spawnrad/oauth-bundle conflict with Laravel's Symfony dependencies in Composer?
- Likely yes. Laravel pins transitive Symfony packages such as http-foundation, console, and finder, and requiring this bundle can force conflicting versions during resolution. The repository has no documented constraint strategy or tested dependency set. Resolve this in a scratch project before planning any integration work.
- Does spawnrad/oauth-bundle integrate with Laravel Socialite?
- No, it does not provide a Socialite driver or bridge. Socialite has its own provider contract, and the bundle follows Symfony's security and dependency-injection conventions instead. If Socialite is your target, this package is reference material rather than a drop-in integration.
- How does spawnrad/oauth-bundle handle access and refresh tokens?
- The package describes built-in token management with refresh handling and secure storage hooks, inherited from the HWIOAuthBundle architecture. In practice, token persistence is delegated to your application's storage layer through Symfony-style services. You remain responsible for encryption, rotation, and revocation policy.
- Does spawnrad/oauth-bundle include middleware and facades to protect routes?
- The description mentions middleware for protecting routes, but the underlying code is Symfony-based and does not ship Laravel middleware or facades. Route protection in a Laravel app would require writing your own middleware or adapting the bundle's services. That adaptation cost should be budgeted explicitly.
- Is spawnrad/oauth-bundle safe to use in production for authentication?
- Treat it cautiously. It is a personal fork of a credential-handling library with no stated divergence rationale, no CVE-response process, and no visible production users. Authentication code has the largest blast radius in an application, so provenance and maintenance ownership matter more here than in most dependencies.
- What are the best alternatives to spawnrad/oauth-bundle for Laravel OAuth?
- For most Laravel applications, laravel/socialite plus community socialiteproviders drivers covers the common providers and stays inside Laravel's security-patch cadence. For unsupported identity providers, implement Socialite's AbstractProvider contract as an internal custom provider. Both options keep you on idioms the team already owns.
- Can I reuse spawnrad/oauth-bundle's provider classes in a custom Socialite provider?
- Yes, and that is usually the best use of the repository. Its Resource Owner classes document how each provider returns and normalizes user data, which you can port into a Socialite custom provider's getUserByToken and mapUserToObject methods. Check the license terms before copying, and keep the ported code under your own maintenance.