Guzzle OAuth Subscriber

Guzzle OAuth Subscriber is the official OAuth 1.0 signing middleware for the Guzzle HTTP client. It signs outgoing requests using a consumer key, consumer secret, OAuth token, and token secret, handling the signature base string, nonce, and timestamp so you can call OAuth 1.0 protected APIs without implementing the protocol yourself.

Installed as an Oauth1 middleware pushed onto Guzzle’s HandlerStack, it supports HMAC-SHA1, HMAC-SHA256, RSA-SHA1, and plaintext signature methods and integrates cleanly with Guzzle 7, making it a drop-in way to authenticate against services such as the Twitter REST API.

What You Get

• An Oauth1 middleware that signs Guzzle requests with the OAuth 1.0 protocol
• Support for HMAC-SHA1, HMAC-SHA256, RSA-SHA1, and plaintext signature methods
• Automatic generation of nonce, timestamp, and OAuth signature parameters
• Configurable request-signing options including realm, token, and callback
• Seamless integration with Guzzle 7 via the HandlerStack middleware system

Common Use Cases

• Authenticating requests to OAuth 1.0 APIs such as the Twitter REST API
• Signing server-to-server API calls that still require OAuth 1.0
• Adding OAuth 1.0 support to an existing Guzzle-based API client
• Handling the three-legged OAuth 1.0 request-token and access-token flows

Under The Hood

Architecture - The package is a single class, GuzzleHttp\Subscriber\Oauth\Oauth1 (src/Oauth1.php, ~450 lines), used as PSR-7 middleware. When a request carries the auth => ‘oauth’ option, its __invoke handler collects OAuth parameters, builds the signature base string from the normalized URI and query/body parameters, computes the signature with the configured method (HMAC-SHA1, HMAC-SHA256, RSA-SHA1, or plaintext), and injects the resulting Authorization header before passing the request down the handler stack.

Tech Stack - Pure PHP targeting 7.2.5+ and Guzzle 7.13.3+, depending on guzzlehttp/guzzle and guzzlehttp/psr7. The project uses PHPUnit for testing and PHPStan (with a baseline) for static analysis, wired together via a Makefile and Composer bin plugins.

Code Quality - The repository includes a PHPUnit suite (tests/Oauth1Test.php) exercising the signing logic and a PHPStan configuration enforcing static-analysis rules, indicating an actively maintained, type-checked codebase. The single-responsibility middleware keeps the surface area small and auditable.

API Design - Usage is idiomatic Guzzle: construct new Oauth1([…credentials]), push it onto a HandlerStack::create(), and set ‘auth’ => ‘oauth’ per request. The constructor’s associative options map (consumer_key, consumer_secret, token, token_secret, signature_method, realm) is self-documenting, and the README walks through a complete Twitter example with minimal boilerplate.