- What is splash/oauth2 used for in Laravel?
- splash/oauth2 is presented as a Laravel-friendly OAuth2 package for API connectors, covering secure token handling, authorization flows, and route protection. The available description positions it around OAuth2 authentication for Laravel/PHP applications and connecting services to standard OAuth2 providers. Before adopting it, confirm whether your use case needs an authorization server or a client/connector layer, because the package scope is described ambiguously in available notes.
- Is splash/oauth2 an OAuth2 authorization server or a client library?
- That is the key ambiguity to resolve first. The package description and technical notes describe server-side features such as issuing and validating Bearer tokens, middleware, scopes, and Eloquent models for clients, tokens, and scopes, which is the laravel/passport problem space. Earlier internal notes evaluated it as a client-side connector in the league/oauth2-client space. Inspect the code or ask the maintainer before choosing it for either role.
- How do I install splash/oauth2 in a Laravel app?
- The expected Laravel flow is a Composer require followed by publishing any service-provider config and migrations, then registering middleware as needed. However, installation is only feasible after confirming the GitLab repository is publicly readable and the package is Composer-installable or vendorable. Also verify that a declared license permits your intended internal or redistributed use.
- Which OAuth2 grant types does splash/oauth2 support?
- Available context says it is backed by authorization-code, client-credentials, and password grants. That list should be verified in the code, along with whether authorization code supports PKCE and whether refresh-token rotation is implemented. The presence of password grant by default is worth scrutinizing because it is deprecated in OAuth 2.1.
- Does splash/oauth2 replace Laravel Passport?
- It may occupy the same authorization-server problem space as Laravel Passport, since it reportedly issues and validates tokens, ships middleware and scopes, and stores clients, tokens, and scopes via Eloquent. It is not a first-party Laravel package, so replacing Passport with it is a significant risk decision. Check for service-provider and migration collisions with Passport before trying both in one application.
- What PHP and Laravel versions does splash/oauth2 support?
- The provided context does not list supported PHP or Laravel version constraints. You need to read composer.json to confirm that its constraints accept your target PHP and Laravel majors. Also check whether its service-provider bindings and migrations collide with existing auth packages.
- Is splash/oauth2 safe for production?
- Authorization-server code is high-consequence code, and the available assessment flags several unverified concerns: client secret handling, redirect URI allowlisting, state/PKCE enforcement, scope escalation, token revocation, and refresh-token rotation. It also notes no adoption signal and a likely bus factor of one, so edge cases may not have been pressure-tested. Treat production use as gated on a code review and security review, not just a successful install.
- How does splash/oauth2 handle tokens and scopes?
- The description says it uses Eloquent models for clients, tokens, and scopes, and provides middleware for protecting routes and validating Bearer tokens. Token-at-rest posture, encryption, key rotation, log redaction, and audit trails are not established in the available context. Verify those details directly in the code before storing real credentials or production tokens.
- Can I use splash/oauth2 to connect to third-party APIs like Google or GitHub?
- That depends on whether the package is a client/connector layer or an authorization server. The blurb mentions connecting services with standard OAuth2 providers, but the technical assessment says the package scope is ambiguous and that earlier notes treated it as a league/oauth2-client-style connector. If you need third-party integrations, confirm it delegates to a maintained client library or implements the client side correctly.
- Is splash/oauth2 maintained, and what should I use instead?
- The available assessment notes zero stars and zero dependents on a non-GitHub host, no support commitment, and a risk that the GitLab project goes read-only without notice. For an authorization server in Laravel, the natural comparison is laravel/passport backed by league/oauth2-server; for client integrations, compare league/oauth2-client and Laravel Socialite. Choose splash/oauth2 only if its convention fit with the Splash toolchain or simpler surface justifies the maintenance risk.