A standards compliant OAuth 2.0 authorization server and resource server written in PHP.

The framework is provided as a Composer package which can be installed by adding the package to your composer.json file:

{
	"require": {
		"league/oauth2-server": "3.*"
	}
}

• Laravel Service Provider by @lucadegasperi
• Laravel Eloquent implementation by @ScubaClick (under development)

The library features 100% unit test code coverage. To run the tests yourself run phpunit from the project root.

[master]

[develop]

The authorization server is a flexible class and the following core specification grants are implemented:

• authorization code (section 4.1)
• refresh token (section 6)
• client credentials (section 2.3.1)
• password (user credentials) (section 4.3)

The resource server allows you to secure your API endpoints by checking for a valid OAuth access token in the request and ensuring the token has the correct scope(s) (i.e. permissions) to access resources.

Custom grants can be created easily by implementing an interface.

See the project releases page

Please see CONTRIBUTING for details.

Bugs and feature request are tracked on GitHub

This package is released under the MIT License. See the bundled LICENSE file for details.

This code is principally developed and maintained by Alex Bilbie.

Special thanks to:

• Dan Horrigan
• Nick Jackson
• Michael Gooden
• Phil Sturgeon
• and all the other contributors

The initial code was developed as part of the Linkey project which was funded by JISC under the Access and Identity Management programme.