lauroguedes / laravel-sso

v1.0.2 2026-09-12 18:10 UTC

Requires

• php: ^8.3
• admin9/laravel-oidc-server: ^1.2
• inertiajs/inertia-laravel: ^3.0
• laravel/chisel: ^0.1.0
• laravel/fortify: ^1.37.2
• laravel/framework: ^13.17
• laravel/passport: ^13.0
• laravel/tinker: ^3.0
• laravel/wayfinder: ^0.1.14
• petebishwhip/laradocs: ^1.1
• spatie/laravel-activitylog: ^5.1
• spatie/laravel-permission: ^8.0

Requires (Dev)

• fakerphp/faker: ^1.24
• larastan/larastan: ^3.9
• laravel/boost: ^2.2
• laravel/pail: ^1.2.5
• laravel/pao: ^1.0.6
• laravel/pint: ^1.27
• laravel/sail: ^1.53
• mockery/mockery: ^1.6
• nunomaduro/collision: ^8.9.3
• pestphp/pest: ^5.1
• pestphp/pest-plugin-laravel: ^5.0

MIT

• oauth2
• SSO
• laravel
• oidc
• starter-kit
• openid-connect
• identity-provider

Published on Packagist.org on 2026-09-12 18:12 UTC

README

Laravel SSO

A self-hosted OpenID Connect provider.
Register your applications, and sign in to all of them with one account.

Run your own identity provider. Your people get one account and one sign-in page. Your applications get standard OpenID Connect and never see a password.

Applications connect with any client library. Nothing on the other end has to be Laravel, or PHP.

It is deliberately smaller and easier to read than Keycloak: a Laravel application you can clone, configure, deploy and own completely.

Features

• OAuth 2.0: authorization code with PKCE, refresh tokens, client credentials.
• OpenID Connect: discovery, published key set, ID Tokens, UserInfo, introspection, revocation, RP-initiated logout.
• Applications: registered in the interface, each with its own credentials, redirect URIs and scopes. Secrets hashed, redirect URIs matched exactly.
• Per-application roles: every application defines its own, and its tokens carry the ones its users hold there. One application never learns about another.
• Users: password reset, two-factor authentication, passkeys, email verification.
• Delegation: a Developer role that hands somebody one application without handing them the server.
• Sessions and audit trail: every session and token revocable. Who did what, from where, and when.
• Themeable: brand, palette and layout changed from the interface, or pinned through the environment.

Quick start

laravel new my-sso --using=lauroguedes/laravel-sso

Or clone it:

git clone https://github.com/lauroguedes/laravel-sso
cd laravel-sso
composer setup
php artisan sso:install

sso:install generates the signing keys, seeds the platform roles, offers to create your first administrator, and prints the endpoints your applications need. It is safe to run again.

Want something to look at? See it running at laravel-sso.lauroguedes.dev, or seed your own copy:

php artisan db:seed --class=SsoDemoSeeder

Connecting an application

Register it, then hand its developer the issuer and the credentials:

Issuer	https://auth.example.com
Discovery	https://auth.example.com/.well-known/openid-configuration
Client ID	shown on the application's page
Client secret	shown once, at creation

Most libraries need only the issuer. They read the rest from the discovery document.

Documentation

Full documentation ships with the server and is served from it at /docs: installation, configuration, administration, integration, security and the architecture. Anyone signed in can read it, and on a public demo so can every visitor. Read it online at laravel-sso.lauroguedes.dev/docs.

Tests

composer ci:check

Formatting, lint, front-end types, Pint, PHPStan level 7 and the test suite.

Requirements

PHP 8.3+, Node 20.19+ or 22.12+, and SQLite, MySQL, MariaDB or PostgreSQL.

Contributing

Issues and pull requests are welcome. Every change carries a test, and composer ci:check has to pass. See the contributing guide.

Licence

MIT.

If this is useful to you, please star the repository.
It is the thing that helps other people find it.

⭐ Star this project  ·  ☕ Buy me a coffee

_{Crafted by an Artisan ♥ Lauro Guedes}