- Is tmhOAuth a Laravel package?
- No. tmhOAuth is a standalone single-class PHP library with no service provider, facade, config publishing, or container bindings. In a Laravel app you either instantiate tmhOAuth directly or, preferably, wrap it behind your own interface. Treat it as a procedural dependency rather than a Laravel-native package.
- How do I install tmhOAuth in a Laravel project?
- Run composer require themattharris/tmhoauth; it only requires ext-curl and ext-openssl. Because it is not a Laravel package there is nothing to publish or register. The recommended approach is to install it and immediately wrap it in a small adapter class bound in a service provider so controllers and jobs never touch it directly.
- Does tmhOAuth support PHP 8 and modern Laravel versions?
- Officially it does not; the last meaningful upstream activity predates PHP 7, so expect PHP 8 deprecations such as curly-brace string offsets and dynamic property warnings. Many teams vendor a forked copy and patch these issues themselves. Validate against your target PHP and Laravel version before committing, and budget for a fork rather than a clean composer require.
- Which APIs still require OAuth 1.0A today?
- OAuth 1.0A is largely legacy; the main remaining consumer is the Twitter/X v1.1 API plus a handful of older enterprise or niche providers. If your target provider supports OAuth 2.0, use Socialite or a modern OAuth 2.0 client instead. tmhOAuth only makes sense when a provider genuinely requires 1.0A request signing.
- How do I send a signed request to the Twitter API with tmhOAuth?
- Instantiate tmhOAuth with a config array containing consumer key and secret plus user token and secret, then call $tmh->request('GET', $tmh->url('1.1/statuses/home_timeline.json'), $params). Inspect $tmh->response['code'] and $tmh->response['response'] afterward. The library handles HMAC-SHA1 signing and the cURL call for you.
- How should I integrate tmhOAuth into a Laravel service provider?
- Define an interface such as App\Contracts\OAuth1Client with a single send() method, then implement it with a TmhOAuthClient class that wraps the library. Bind that implementation in a service provider, read credentials from config/services.php backed by env vars, and inject the interface wherever needed. This keeps the library mockable and contains its quirks to one class.
- How does tmhOAuth report errors?
- It does not throw exceptions. Failures come back in the public $response array as code, response, and error keys, so any caller that forgets to check the code will silently swallow auth failures. Wrap every call in your adapter and throw a typed exception when the status code is not successful.
- How do I test code that uses tmhOAuth?
- Do not test against the real API. Create a FakeOAuth1Client implementing your OAuth1Client interface that returns canned response objects, then bind it in the test container. For integration-level signature validation, use a provider sandbox and verify signed requests separately.
- Is tmhOAuth safe and maintained for production use?
- It is effectively unmaintained: no release cadence, no security advisory process, and a single-maintainer bus factor. If you adopt it, vendor a forked copy with a named internal owner and document an exit trigger such as provider migration, a PHP version bump, or a fixed date. Do not rely on upstream to patch a CVE.
- What are the alternatives to tmhOAuth for OAuth 1.0A in Laravel?
- There is no first-party Laravel OAuth 1.0A client; Socialite covers OAuth 2.0 only. Common alternatives are league/oauth1-client, Guzzle's OAuth subscriber middleware, or a small custom signer on top of Laravel's HTTP client. Evaluate whether your provider can move to OAuth 2.0 first, since that removes the need for a 1.0A library entirely.