FOSOAuthServerBundle (klapaudius)

This package is an actively maintained fork of FOSOAuthServerBundle that turns a Symfony application into an OAuth2 authorization and resource server. It handles the full OAuth2 flow: registering clients, issuing authorization codes, exchanging them for access and refresh tokens, and validating those tokens on protected endpoints.

Originally created to keep the popular FriendsOfSymfony bundle working on modern Symfony, it now targets Symfony 5, 6, 7, and 8 across dedicated branches. It stores tokens and clients through Doctrine ORM or MongoDB ODM, integrates with Symfony Security, and exposes the standard OAuth2 endpoints so you can secure your own APIs.

What You Get

• Authorization and token endpoints implementing the OAuth2 grant flows
• Client, access-token, refresh-token, and auth-code models with Doctrine ORM or MongoDB ODM storage
• A Symfony Security listener that authenticates API requests via OAuth2 tokens
• Console commands for managing OAuth2 clients
• Configurable token lifetimes and supported grant types
• Support for Symfony 5, 6, 7, and 8 via versioned branches

Common Use Cases

• Standing up an OAuth2 provider to secure your own REST APIs
• Issuing access tokens to first- and third-party client applications
• Adding token-based authentication to a Symfony backend
• Migrating a legacy FOSOAuthServerBundle project onto modern Symfony

Under The Hood

Architecture - The bundle is organized by concern at the package root: Controller exposes the OAuth2 authorize/token endpoints, Storage adapts persistence to the underlying klapaudius/oauth2-php server engine, and Model/Entity/Document define clients, tokens, and auth codes for ORM and MongoDB. A Security layer plugs a token-authenticating listener into Symfony’s firewall, DependencyInjection handles configuration, and Command provides client-management CLI. Routing exposes the endpoints and Twig renders the authorization form.

Tech Stack - PHP 8+ on Symfony 7/8 (framework-bundle, security-bundle, form, twig-bundle, dependency-injection) plus doctrine-bundle, built on the klapaudius/oauth2-php OAuth2 engine. Dev tooling includes PHPUnit 12, PHPStan (with phpstan-phpunit), php-cs-fixer, and optional Doctrine ORM/MongoDB ODM.

Code Quality - The project runs GitHub Actions tests with Codecov coverage and a tests/ tree mirroring each source area (Controller, Storage, Entity, Document, Form, Command). PHPStan and a Makefile support consistent local checks, and the multi-branch strategy keeps each Symfony major version green.

API Design - As an OAuth2 server, setup is inherently involved: you configure storage, define client and token classes, wire a firewall, and register routes following the Resources/doc/index.md guide. Once configured, the standard endpoints and Symfony Security integration make protecting APIs declarative, but the initial learning curve reflects OAuth2’s complexity rather than the bundle’s own.