# thephpleague/oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server

Repository: https://github.com/thephpleague/oauth2-server
Canonical: https://ross.abutalabs.com/products/oauth2-server
Homepage: https://oauth2.thephpleague.com
Language: PHP
License: MIT
License Family: permissive
Topics: oauth2, oauth2-server, oauth, php
Last push: 2026-06-25T15:28:43+00:00

## Health v2 (maintenance only)
Score: 87/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 89, release rhythm 78, longevity 100
- inputs: {"age_days": 5203, "days_push": 69, "days_rel": 69, "gap_med": 38, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6662, forks 1136 (observed 2026-08-28T04:09:47.475341+00:00)

## What it is
A standards-compliant OAuth 2.0 authorization server library for PHP, supporting all major grants (authorization code, client credentials, password, refresh, implicit, device) and RFCs 6749, 6750, 7519, 7636, and 8628. It is PSR-7 based and integrates with frameworks like Laravel, Symfony, Slim, and Drupal.

## Use cases
- issue OAuth 2.0 access tokens for my API
- implement an authorization code grant server in PHP
- add JWT-based bearer token authentication to a REST API
- support device authorization flow for smart TV apps
- secure a Laravel API with OAuth 2.0
- implement PKCE for public clients
- issue and refresh access tokens for third-party clients

## When to choose
- you need a spec-compliant OAuth 2.0 authorization server in PHP
- you want to protect your own API with access tokens and refresh tokens
- you need framework-agnostic OAuth via PSR-7
- you need device flow or PKCE support

## When to avoid
- you only need an OAuth 2.0 client to consume third-party APIs
- you want a full identity provider with user management, SSO, or OpenID Connect out of the box
- you are not working in PHP

## Facets
- artifact type: library
- maturity: stable
- function: auth, api-framework, middleware
- domain: security, apis, web-development, backend
- platform: php, self-hosted
- tags: oauth2, oauth2-server, jwt, authorization-server, psr-7, bearer-tokens, pkce, device-flow, web-server

## Member repositories
- thephpleague/oauth2-server (main) score 87

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:47.475341+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:43:02.586750+00:00, confidence not recorded.
  - readme: https://github.com/thephpleague/oauth2-server (fetched 2026-08-28T04:09:47.475341+00:00, sha 6630ca8133a8)
  - homepage: https://oauth2.thephpleague.com (fetched 2026-08-29T08:39:17.072332+00:00, sha 88b352b455ad)
  - site_page: https://oauth2.thephpleague.com/installation (fetched 2026-08-29T08:39:17.074897+00:00, sha a4d4a4d8d615)
  - site_page: https://oauth2.thephpleague.com/V4-docs (fetched 2026-08-29T08:39:17.078406+00:00, sha 125301b2fd7a)
  - site_page: https://oauth2.thephpleague.com/framework-integrations (fetched 2026-08-29T08:39:17.076909+00:00, sha a4b4510f11ea)
- Data as of 2026-08-30T08:39:29.467469+00:00.