webservco / discogs-auth

v3.11.0 2026-10-03 16:35 UTC

Requires

• php: ^8.3
• webservco/framework: @dev

Requires (Dev)

• pds/skeleton: ^1
• php-parallel-lint/php-console-highlighter: ^1
• php-parallel-lint/php-parallel-lint: ^1
• phpstan/phpstan: ^2
• phpstan/phpstan-deprecation-rules: ^2
• phpstan/phpstan-phpunit: ^2
• phpstan/phpstan-strict-rules: ^2
• phpunit/phpunit: ^13
• slevomat/coding-standard: ^8
• squizlabs/php_codesniffer: ^4
• webservco/coding-standards: ^2
• webservco/component-common: ^2

Suggests

• phpdocumentor/phpdocumentor: phpDocumentor v3 (global installation)

MIT

• webservco
• discogs-auth

Published on Packagist.org on 2026-10-04 15:15 UTC

README

A PHP library for webservco/framework.

Builds the Authorization header for each Discogs authentication type: app key, personal access token and OAuth.

Note: webservco/framework is considered legacy. It has been replaced by individual components, please see webservco/sandbox.

• Requires: PHP 8.3+, webservco/framework (only for the exception base class)
• Related: webservco/discogs-api (takes an AuthInterface and sends its header with every request)

Installation

composer require webservco/discogs-auth

Usage

use WebServCo\DiscogsAuth\Discogs\User;

// \WebServCo\DiscogsAuth\Interfaces\AuthInterface
$auth = new User($personalAccessToken);

// "Discogs token=..."
$header = $auth->getAuthHeader();

Pick the class that matches the access you need:

Class	Constructor	Use
Discogs\App	consumer key, consumer secret	Database access as an app, no user.
Discogs\User	personal access token	Your own account.
OAuth\RequestToken	consumer key, consumer secret, callback URL	OAuth step 2: GET oauth/request_token.
OAuth\AccessToken	consumer key, consumer secret, request token, request token secret, verifier	OAuth step 4: POST oauth/access_token.
OAuth\OAuth	consumer key, consumer secret, access token, access token secret	Every request made on behalf of another user.

Namespaces are relative to WebServCo\DiscogsAuth\.

OAuth flow

1. Get a consumer key and secret by registering an app on Discogs.
2. Call oauth/request_token with RequestToken. Keep the returned oauth_token and oauth_token_secret.
3. Redirect the user to https://discogs.com/oauth/authorize?oauth_token=.... Discogs redirects back to the callback URL with oauth_verifier, or with denied if the user refused.
4. Call oauth/access_token with AccessToken. Store the returned token and secret.
5. Use OAuth with the stored token and secret for every request after that, starting with oauth/identity.

The webservco/discogs-examples project has a page for each step.

Notes

The OAuth headers use the PLAINTEXT signature method, so only send them over HTTPS. Each call to getAuthHeader() creates a new nonce and timestamp.

For the "Invalid signature. Expected signature base string" error, see these Discogs forum threads: 730066, 704059.

Development

# Start project.
ddev start
# Install dependencies.
ddev c u
# Run all validations.
ddev c c
# Run unit tests.
ddev c test:d

License

MIT