league/oauth2-client

league/oauth2-client provides a base AbstractProvider class implementing the OAuth 2.0 Authorization Framework (RFC 6749), covering authorization-code, client-credentials, password, and refresh-token grants, PKCE, and state-based CSRF protection. It ships a GenericProvider for any Bearer-token-based OAuth 2.0 server out of the box, and its provider abstraction is the foundation for dozens of official and third-party packages (GitHub, Google, Facebook, LinkedIn, and more) that add provider-specific endpoints and user-data mapping.

What You Get

• An AbstractProvider base class implementing the OAuth 2.0 authorization-code, client-credentials, password, and refresh-token grants
• A ready-to-use GenericProvider for any OAuth 2.0 server that issues Bearer tokens without provider-specific code
• AccessToken and ResourceOwner value objects representing token responses and authenticated user data
• Built-in PKCE and state-parameter CSRF protection for the authorization-code flow

Common Use Cases

• Building a “Login with X” button flow against any standards-compliant OAuth 2.0 identity provider
• Authorizing server-to-server API access via the client-credentials grant against a third-party API
• Extending AbstractProvider to create a first-party or third-party provider package for a specific service (GitHub, Google, etc.)
• Refreshing expired access tokens transparently using the refresh-token grant in a long-running integration

Under The Hood

Architecture: AbstractProvider.php (961 lines) is the core class every provider extends, delegating grant-specific request building to a Grant hierarchy (src/Grant: AuthorizationCode, ClientCredentials, Password, RefreshToken, all extending AbstractGrant and produced via a GrantFactory), wrapping HTTP calls through a configurable OptionProvider strategy and Guzzle-compatible client, and turning token responses into src/Token/AccessToken objects plus a GenericResourceOwner (or subclass-defined ResourceOwnerInterface implementation) for user data. Tech Stack: Plain PHP (7.1 through 8.5 supported) with guzzlehttp/guzzle as its HTTP transport dependency, PSR-1/2/4/7 compliant, tested via PHPUnit with Codecov coverage tracking and a GitHub Actions CI workflow. Code Quality: A 23-file test/ directory mirrors the src/ structure (Provider, Grant, Token, Tool tests), covering grant flows, PKCE, and error handling; the codebase favors composition (Grant objects, OptionProvider strategies) over inheritance-heavy design for the parts meant to be swapped, while AbstractProvider itself is the one large class subclasses extend directly. API Design: The library defines a stable extension contract, override getBaseAuthorizationUrl, getBaseAccessTokenUrl, getResourceOwnerDetailsUrl, and createResourceOwner to add a new provider, which is why dozens of official and third-party provider packages exist against a shared, well-documented base class.