Weave Code
Oauth2 Server Bearer Access Token Bundle Laravel Package
spomky-labs/oauth2-server-bearer-access-token-bundle
Symfony bundle that adds OAuth 2.0 Bearer access token support to your authorization server, handling token generation, validation, and RFC 6750-compliant bearer authentication so protected APIs can accept and verify access tokens with minimal configuration.
Symfony2 OAuth2 Server Bearer Access Token Manager Bundle
Frequently asked questions about Oauth2 Server Bearer Access Token Bundle
- Can I use spomky-labs/oauth2-server-bearer-access-token-bundle in a Laravel application?
- No. This is a Symfony 2 bundle that registers a bearer access-token manager into Symfony's dependency injection container and expects the sibling spomky-labs OAuth2 server bundles to be present. Nothing in it is wired for Laravel's service container, service providers, or config system, so you would be rewriting the integration rather than installing a package. In a Laravel app the idiomatic choice is laravel/passport, which wraps league/oauth2-server.
- How do I install spomky-labs/oauth2-server-bearer-access-token-bundle?
- Installation is Composer-based, followed by registering the bundle in the Symfony 2 AppKernel and configuring the bearer token manager service through the bundle's configuration tree. That AppKernel-based registration model was removed in Symfony 4 in favour of config/bundles.php, so the documented install steps do not translate to modern Symfony. There is no Laravel installation path at all.
- Which PHP and Symfony versions does this bearer token bundle support?
- It targets the Symfony 2 era, with PHP version constraints that predate PHP 7.4 and 8.x type semantics. The bundle is incompatible with Symfony Flex and the bundle registration model used from Symfony 4 onward. Expect dependency resolution to fail on a current PHP runtime without significant archaeology.
- What does this bundle actually do - is it a complete OAuth 2.0 authorization server?
- It is a thin integration shim. Its only job is to wire a bearer access-token manager into the Symfony DI container and expose the token grant and validation surface consumed by the sibling spomky-labs OAuth2 server packages. It is not self-contained: it presumes OAuth2ServerBundle, storage and Doctrine bundles, and the older oauth2-server-php lineage are already installed.
- Does it support PKCE, token revocation, token introspection, or JWT access tokens?
- No. The bundle predates RFC 7636 (PKCE), RFC 7009 (revocation), RFC 7662 (introspection), RFC 9068 (JWT access tokens), and sender-constrained token mechanisms such as DPoP and mTLS. If your threat model requires any of these, the package is disqualifying on its own. league/oauth2-server and laravel/passport cover the modern surface area.
- Is spomky-labs/oauth2-server-bearer-access-token-bundle safe to run in production?
- Treat it as high risk. The repository shows no release cadence, no dependents, and no visible security disclosure process, which means there is no signal that past vulnerabilities were triaged. Bearer token issuance and validation are security-critical paths, so adopting it means owning every future CVE in an unmaintained chain. The only defensible scenario is a frozen legacy Symfony 2 application already running it, where the alternative is a larger rewrite.
- What is the Laravel equivalent of this Symfony bearer token bundle?
- For full OAuth 2.0 authorization server capabilities, use laravel/passport, which itself wraps league/oauth2-server and gives you grant types, scopes, token TTLs, and revocation behind familiar Artisan commands. If you only need first-party API tokens rather than a full OAuth server, Laravel Sanctum is lighter and sufficient. Either way you should not attempt to port the Symfony bundle's wiring.
- How do I migrate from this bundle to a maintained OAuth 2.0 server?
- Treat the bundle as a strangler-fig source rather than a dependency. First document the token contract the legacy system exposes: grant types in use, token format, TTLs, storage schema, and scopes. Then stand up league/oauth2-server (or Passport) behind the same endpoints and validate parity, dual-run against a token-store-compatible schema, issue new tokens from the new server, and accept old opaque tokens until they expire before decommissioning. Because bearer tokens here are opaque, the cutover is bounded by token TTL rather than requiring a big-bang switch.
- Should I self-host an OAuth 2.0 authorization server or use an external identity provider?
- If there is no contractual or regulatory driver requiring in-app token issuance, an external IdP such as Keycloak, Auth0, Cognito, or Entra ID is usually the lower-risk option. It removes the burden of owning security-critical token issuance, rotation, and revocation logic. Self-hosting only makes sense when you need deep control over the user store or the token contract.
- How do I test bearer token authentication in a Laravel app once I move to Passport or Sanctum?
- Use Laravel's built-in helpers rather than hitting real endpoints: Sanctum::actingAs or Passport::actingAs for user-context tests, and withToken or withHeader for raw bearer header assertions. Assert both the happy path and rejection cases such as expired, revoked, and wrong-scope tokens, since those are the paths that actually matter in production. Keep the token contract tests you wrote while documenting the legacy bundle so you can verify parity after migration.
Weaver
How can I help you explore Laravel packages today?