all-sav / socialite-vkid

dev-main 2026-09-11 23:51 UTC

Requires

• php: ^8.2
• ext-json: *
• socialiteproviders/manager: ^4.4

MIT

• Aleksander Savelyev

• oauth
• oauth2
• provider
• laravel
• vkontakte
• vk
• socialite
• pkce
• vkid

Published on Packagist.org on 2026-09-11 23:53 UTC

README

OAuth 2.1 + PKCE provider for new VK applications (id.vk.ru).

Classic socialiteproviders/vkontakte (oauth.vk.ru) does not work for apps created in the VK ID cabinet.

Requirements

• PHP 8.2+
• Laravel Socialite via socialiteproviders/manager
• A cache store (Redis/database/file) — PKCE code_verifier is stored in cache, so stateless() works

Install

composer require all-sav/socialite-vkid

Configure config/services.php

'vkid' => [
    'client_id' => env('VK_CLIENT_ID'),
    'client_secret' => env('VK_CLIENT_SECRET'),
    'redirect' => env('VK_REDIRECT_URI'),

    // Public apps: leave false (default). Confidential apps: true and put
    // the *service token* in client_secret — it is sent as service_token.
    'confidential' => env('VK_CONFIDENTIAL', false),

    // Optional PKCE cache tuning
    // 'pkce_ttl' => 10,
    // 'cache_store' => 'redis',
    // 'cache_prefix' => 'socialite:vkid:pkce:',
],

Local development (VK ID)

VK ID only accepts localhost on ports 80 or 443:

• Base domain: localhost
• Trusted redirect URL: http://localhost/api/auth/vk/callback (no port in the URL)

Register the provider

Laravel 11+

use Illuminate\Support\Facades\Event;
use SocialiteProviders\Manager\SocialiteWasCalled;
use SocialiteProviders\VkId\Provider;

public function boot(): void
{
    Event::listen(function (SocialiteWasCalled $event): void {
        $event->extendSocialite('vkid', Provider::class);
    });
}

Laravel 10 or below

protected $listen = [
    \SocialiteProviders\Manager\SocialiteWasCalled::class => [
        \SocialiteProviders\VkId\VkIdExtendSocialite::class.'@handle',
    ],
];

Usage

use Laravel\Socialite\Facades\Socialite;

return Socialite::driver('vkid')->stateless()->redirect();

// Callback:
$user = Socialite::driver('vkid')->stateless()->user();

Important: OAuth state vs account linking

VK ID always returns state. If you also use state as a link-account nonce, only treat it as a link when your own cache key exists — otherwise normal logins will look like expired link attempts.

Returned user fields

• id (VK user_id)
• name
• email (when granted)
• avatar
• raw payload: first_name, last_name, phone, birthday, …

Reference

• VK ID: auth without SDK (Web)
• Token exchange (grant_type=authorization_code)