EvaOAuth

A simple OAuth 1.0a / OAuth 2.0 client for PHP.

EvaOAuth gives OAuth 1.0a and OAuth 2.0 the same application-level API, so most integrations only need to care about:

authorize → callback → token + user

It is framework-agnostic and works with any PSR-compatible PHP application. 中文

composer require evaengine/eva-oauth:^2.0

Requires PHP 8.2+.

GitHub login takes only a few lines.

use Eva\EvaOAuth\OAuth;
use Eva\EvaOAuth\Provider\GitHub;

session_start();

$oauth = new OAuth([
    'github' => new GitHub(
        clientId: $_ENV['GITHUB_CLIENT_ID'],
        clientSecret: $_ENV['GITHUB_CLIENT_SECRET'],
        redirectUri: 'https://example.com/oauth/github/callback',
    ),
], httpClient: $httpClient ?? null);

$httpClient is an optional PSR-18 client of your choice; omit it to use the built-in transport.

Start authorization:

header('Location: ' . $oauth->authorize('github'));
exit;

Handle the callback:

$result = $oauth->callback('github', $_GET);

$result->token;
$result->user->id;
$result->user->name;
$result->user->email;

That's the normal EvaOAuth flow.

PKCE, state validation and the OAuth protocol details are handled internally.

Replace the provider:

use Eva\EvaOAuth\Provider\Google;

$oauth = new OAuth([
    'google' => new Google(
        clientId: $_ENV['GOOGLE_CLIENT_ID'],
        clientSecret: $_ENV['GOOGLE_CLIENT_SECRET'],
        redirectUri: 'https://example.com/oauth/google/callback',
    ),
], httpClient: $httpClient ?? null);

Only the provider and its credentials changed. Authorization is still a URL:

$url = $oauth->authorize('google');

The callback is the same call as for GitHub:

$result = $oauth->callback('google', $_GET);

OAuth 1.0a uses the same API.

Flickr is included as the built-in OAuth 1.0a provider:

use Eva\EvaOAuth\Provider\Flickr;

$oauth = new OAuth([
    'flickr' => new Flickr(
        clientId: $_ENV['FLICKR_KEY'],
        clientSecret: $_ENV['FLICKR_SECRET'],
        redirectUri: 'https://example.com/oauth/flickr/callback',
    ),
], httpClient: $httpClient ?? null);

$url = $oauth->authorize('flickr');

The callback is the same call again:

$result = $oauth->callback('flickr', $_GET);

OAuth 1.0a and OAuth 2.0 remain different protocols internally. EvaOAuth only unifies the parts your application normally needs.

Built in:

Adding another standard OAuth provider normally only requires its endpoints, scopes and user identity mapping.

See Advanced Usage.

A successful callback returns an AuthorizationResult:

$result->token;
$result->user;

Common user fields:

$result->user->id;
$result->user->name;
$result->user->email;
$result->user->avatar;
$result->user->emailVerified;

Some providers do not return every field. email, avatar and other optional fields may be null.

Tokens can be explicitly exported for persistence:

$data = $result->token->toArray();

Treat exported token data as sensitive credentials.

The README intentionally covers only the common login flow.

See Advanced Usage for:

• refresh tokens
• calling authenticated APIs
• custom OAuth 1.0a / OAuth 2.0 providers
• custom state storage
• custom PSR-18 HTTP clients
• PSR-3 logging and debugging
• error handling
• token persistence
• security and deployment details

For the internal design, see Architecture.

EvaOAuth 2.0 is a rewrite and is not source-compatible with 1.x.

If you used Service, requestAuthorize(), getAccessToken() or other 1.x APIs, see UPGRADING.md.

BSD-3-Clause.