Authentik Socialite Provider

This package is an Authentik OAuth2 provider for Laravel Socialite, part of the community-maintained Socialite Providers collection. It plugs into Laravel’s Socialite authentication layer to add a self-hosted Authentik instance as a login provider, handling the OpenID Connect authorization, token, and userinfo endpoints against a configurable base_url.

Installation is a single composer require plus a Socialite event listener registration, after which any Laravel app can call Socialite::driver('authentik')->redirect() to hand off login to Authentik and receive back a normalized user object with email, name, and group claims.

What You Get

• Authentik OAuth2/OpenID Connect provider - A Provider class implementing the authorize, token, and userinfo endpoints exposed by an Authentik application.
• Socialite event listener - AuthentikExtendSocialite registers the provider with Laravel’s SocialiteWasCalled event so Socialite::driver('authentik') works out of the box.
• Configurable base_url - Points at any self-hosted Authentik instance rather than a fixed SaaS endpoint, since Authentik is itself self-hostable.
• Refresh token support - A dedicated refreshToken() method posts to Authentik’s token endpoint with grant_type=refresh_token.
• Group claim mapping - Maps Authentik’s OpenID Connect groups claim into the Socialite user object for role/permission logic downstream.

Common Use Cases

• Self-hosted SSO - Teams running their own Authentik instance who want Authentik-backed login in a Laravel application.
• Internal tooling auth - Laravel admin panels and internal tools that delegate authentication to a centrally managed Authentik identity provider.
• Multi-app single sign-on - Organizations using Authentik as a single identity source across several Laravel and non-Laravel apps.
• Group-based access control - Apps that read Authentik group membership from the OAuth2 userinfo response to gate features.

Under The Hood

Architecture The package is a thin extension of the SocialiteProviders manager: AuthentikExtendSocialite::handle() listens for Laravel’s SocialiteWasCalled event and registers Provider::class under the authentik driver name, so no service provider boot wiring beyond a single event listener is required. Provider extends SocialiteProviders\Manager\OAuth2\AbstractProvider and only overrides the pieces specific to Authentik: it builds the authorize and token URLs from a required base_url config value, fetches userinfo with a bearer token via Guzzle, and maps the OpenID Connect claims onto Socialite’s User object. If the Authentik AbstractProvider base class changes its OAuth2 flow, every method here would need to follow.

Tech Stack PHP 8.0+ targeting Laravel via socialiteproviders/manager ^4.4, which itself wraps laravel/socialite. HTTP calls to Authentik’s /application/o/authorize/, /application/o/token/, and /application/o/userinfo/ endpoints go through GuzzleHttp’s RequestOptions, and responses are decoded with json_decode. The package is PSR-4 autoloaded under SocialiteProviders\Authentik\ and has no other runtime dependencies.

Code Quality This repository is a read-only subtree split of the SocialiteProviders/Providers monorepo, so it contains only the three source files and a README - no tests or CI configuration live here; testing and CI for this provider happen upstream in the parent monorepo. The code itself follows the same conventions as every other Socialite provider in the collection: typed method signatures where the parent class expects them, InvalidArgumentException thrown explicitly when base_url is missing, and null-coalescing operators guarding optional claims in mapUserToObject.

What Makes It Unique There is no technical novelty here by design - it deliberately mirrors the same authorize/token/userinfo/refresh pattern used across dozens of other Socialite providers so any Laravel developer already familiar with one provider in the collection can read this one in minutes. The one Authentik-specific detail is the configurable base_url, needed because Authentik is normally self-hosted rather than reachable at a single fixed domain.