Laravel Socialite

Laravel Socialite gives a Laravel application a fluent, uniform interface for authenticating users through third-party OAuth providers, shipping first-party drivers for Bitbucket, Facebook, GitHub, GitLab, Google, LinkedIn, Slack, Twitch, and X. Instead of hand-rolling the OAuth redirect/callback dance, token exchange, and user-profile fetch for each provider, an application calls Socialite::driver('github')->redirect() and Socialite::driver('github')->user() and gets back a normalized user object with name, email, avatar, and the provider’s access token.

The package wraps both OAuth 1.0a (via league/oauth1-client, used for X/Twitter) and OAuth 2.0 flows (via Guzzle and firebase/php-jwt for OpenID Connect providers) behind the same Provider interface, and integrates with Laravel’s service container and facades as a first-party Laravel package maintained by the Laravel team. As of the current major version the maintainers are not accepting new first-party drivers; additional providers are covered by the community-maintained Socialite Providers project.

What You Get

• A Socialite::driver('name')->redirect() / ->user() API that abstracts the OAuth 1/2 authorization-code flow for each supported provider
• First-party drivers for Bitbucket, Facebook, GitHub, GitLab, Google, LinkedIn (including OpenID Connect), Slack (including OpenID Connect), Twitch, and X
• A normalized User object exposing id, name, email, nickname, avatar, and the raw provider access token/refresh token
• Stateless mode for API-driven or mobile OAuth flows that skip Laravel’s session-based CSRF state check
• A Socialite::fake() testing helper for asserting redirect/callback behavior in feature tests without hitting a real provider

Common Use Cases

• Adding “Sign in with Google/GitHub/Facebook” buttons to a Laravel application’s login page
• Building a developer-tools SaaS that authenticates users via their GitHub or GitLab account
• Linking a user’s Slack or Twitch account to enable OAuth-based API calls on their behalf
• Supporting stateless OAuth logins in mobile app backends where session-based state isn’t available

Under The Hood

Architecture - SocialiteManager (extending Laravel’s Manager class) resolves the configured driver name to a concrete provider class under src/Two/ (e.g. GithubProvider, GoogleProvider) or src/One/TwitterProvider for OAuth 1.0a; each provider extends Two/AbstractProvider (or One/AbstractProvider), which implements the shared redirect-URL construction, state/PKCE handling, and token exchange against Guzzle, while individual providers only override provider-specific endpoints and user-mapping logic. SocialiteServiceProvider registers the manager and facade into Laravel’s container. Tech Stack - PHP 7.2/8.x targeting Laravel 6 through 13 (illuminate/contracts, illuminate/http, illuminate/support), using GuzzleHTTP for HTTP calls, firebase/php-jwt for verifying OpenID Connect ID tokens, league/oauth1-client for the OAuth 1.0a (X/Twitter) flow, and phpseclib/phpseclib for cryptographic operations required by some providers. Code Quality - 14 test files under tests/ (run via PHPUnit and Orchestra Testbench, a Laravel package-testing harness) cover each provider’s redirect URL construction, token exchange, and user mapping using Mockery-mocked HTTP responses; the project also runs PHPStan for static analysis. Commit and release activity is steady (81 tagged releases, ~5.3 commits/month), reflecting active first-party maintenance despite the driver-freeze policy. API Design - The public API is deliberately small and consistent across all nine providers: Socialite::driver($name)->redirect() and ->user() are the only two calls most integrations need, with stateless(), scopes(), and with() as fluent modifiers, and Socialite::fake() mirrors Laravel’s other facade-testing helpers (Http::fake(), Mail::fake()) for familiarity.