evaengine / eva-oauth

2.0.0 2026-09-27 08:31 UTC

Requires

• php: ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0
• ext-json: *
• ext-openssl: *
• guzzlehttp/guzzle: ^7.10
• guzzlehttp/psr7: ^2.8
• league/oauth1-client: ^1.11
• league/oauth2-client: ^2.9.1
• psr/http-client: ^1.0
• psr/http-message: ^2.0
• psr/log: ^3.0

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^11.5
• squizlabs/php_codesniffer: ^3.13

BSD-3-Clause

• AlloVince

Published on Packagist.org on 2026-09-27 12:59 UTC

README

A simple OAuth 1.0a / OAuth 2.0 client for PHP.

EvaOAuth gives OAuth 1.0a and OAuth 2.0 the same application-level API, so most integrations only need to care about:

authorize → callback → token + user

It is framework-agnostic and works with any PSR-compatible PHP application. 中文

Installation

composer require evaengine/eva-oauth:^2.0

Requires PHP 8.2+.

Quick Start

GitHub login takes only a few lines.

use Eva\EvaOAuth\OAuth;
use Eva\EvaOAuth\Provider\GitHub;

session_start();

$oauth = new OAuth([
    'github' => new GitHub(
        clientId: $_ENV['GITHUB_CLIENT_ID'],
        clientSecret: $_ENV['GITHUB_CLIENT_SECRET'],
        redirectUri: 'https://example.com/oauth/github/callback',
    ),
], httpClient: $httpClient ?? null);

$httpClient is an optional PSR-18 client of your choice; omit it to use the built-in transport.

Start authorization:

header('Location: ' . $oauth->authorize('github'));
exit;

Handle the callback:

$result = $oauth->callback('github', $_GET);

$result->token;
$result->user->id;
$result->user->name;
$result->user->email;

That's the normal EvaOAuth flow.

PKCE, state validation and the OAuth protocol details are handled internally.

Google

Replace the provider:

use Eva\EvaOAuth\Provider\Google;

$oauth = new OAuth([
    'google' => new Google(
        clientId: $_ENV['GOOGLE_CLIENT_ID'],
        clientSecret: $_ENV['GOOGLE_CLIENT_SECRET'],
        redirectUri: 'https://example.com/oauth/google/callback',
    ),
], httpClient: $httpClient ?? null);

Only the provider and its credentials changed. Authorization is still a URL:

$url = $oauth->authorize('google');

The callback is the same call as for GitHub:

$result = $oauth->callback('google', $_GET);

OAuth 1.0a

OAuth 1.0a uses the same API.

Flickr is included as the built-in OAuth 1.0a provider:

use Eva\EvaOAuth\Provider\Flickr;

$oauth = new OAuth([
    'flickr' => new Flickr(
        clientId: $_ENV['FLICKR_KEY'],
        clientSecret: $_ENV['FLICKR_SECRET'],
        redirectUri: 'https://example.com/oauth/flickr/callback',
    ),
], httpClient: $httpClient ?? null);

$url = $oauth->authorize('flickr');

The callback is the same call again:

$result = $oauth->callback('flickr', $_GET);

OAuth 1.0a and OAuth 2.0 remain different protocols internally. EvaOAuth only unifies the parts your application normally needs.

Supported Providers

Built in:

Provider	Protocol
GitHub	OAuth 2.0
Google	OAuth 2.0
Flickr	OAuth 1.0a

Adding another standard OAuth provider normally only requires its endpoints, scopes and user identity mapping.

See Advanced Usage.

Token and User

A successful callback returns an AuthorizationResult:

$result->token;
$result->user;

Common user fields:

$result->user->id;
$result->user->name;
$result->user->email;
$result->user->avatar;
$result->user->emailVerified;

Some providers do not return every field. email, avatar and other optional fields may be null.

Tokens can be explicitly exported for persistence:

$data = $result->token->toArray();

Treat exported token data as sensitive credentials.

Advanced Usage

The README intentionally covers only the common login flow.

See Advanced Usage for:

• refresh tokens
• calling authenticated APIs
• custom OAuth 1.0a / OAuth 2.0 providers
• custom state storage
• custom PSR-18 HTTP clients
• PSR-3 logging and debugging
• error handling
• token persistence
• security and deployment details

For the internal design, see Architecture.

Migrating from 1.x

EvaOAuth 2.0 is a rewrite and is not source-compatible with 1.x.

If you used Service, requestAuthorize(), getAccessToken() or other 1.x APIs, see UPGRADING.md.

License

BSD-3-Clause.