skeeks/cms-oauth2-server

OAuth 2.1 authorization server for SkeekS CMS

Maintainers

Package info

github.com/skeeks-cms/cms-oauth2-server

Type:yii2-extension

pkg:composer/skeeks/cms-oauth2-server

Transparency log

Statistics

Installs: 50

Dependents: 3

Suggesters: 0

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

1.0.2 2026-07-14 11:41 UTC

Requires

BSD-3-Clause 0499d755a2dec925c88e372fc87701a4a8f3d348

Published on Packagist.org on 2026-07-14 12:36 UTC

This package is auto-updated.

Last update: 2026-07-14 12:36:39 UTC

README

OAuth 2.1 authorization-code server with PKCE, dynamic client registration, resource indicators and scoped bearer tokens for SkeekS CMS integrations.

Authorization-code exchanges issue rotating refresh tokens. Clients can use grant_type=refresh_token to renew access without another browser login. Refresh-token reuse revokes the complete token family and its access tokens. Raw access and refresh tokens are never stored or displayed.

The authorization server metadata advertises both authorization_code and refresh_token grants. A client registers once, stores its client_id and client_secret, completes PKCE authorization for a configured resource, and then persists the returned refresh token in its operating-system credential store. Every successful refresh returns a replacement refresh token; the old value must be discarded immediately.

The package is transport-neutral. Consumers such as skeeks/cms-mcp register their resources and scopes through the oauth2Server.resources configuration.

See AGENTS.md for architecture, resource registration and mandatory engineering rules for AI agents.