thephpleague/oauth2-server

View on GitHub

A spec compliant, secure by default PHP OAuth 2.0 Server

Stars: 6.7k
Forks: 1.1k
Open beginner issues: 0
Indexed issues: 56

Dominant language: PHP
License: MIT
Last GitHub push: Jun 25, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed
PR merge metrics: No merged PRs in 30d

Beginner friendly Everything

Open All

56 open issues indexed

Provide grant type in ACCESS_TOKEN_ISSUED domain events Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

thephpleague/oauth2-server#1513 · Opened Aug 2, 2026
Support RFC 9700-style refresh token rotation grace period with single-successor semantics Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

thephpleague/oauth2-server#1506 · 2 reactions · Opened Apr 22, 2026
Add RFC 8707 Resource Indicators for OAuth 2.0 Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

thephpleague/oauth2-server#1504 · 2 comments · 7 reactions · Opened Apr 14, 2026
Assert that array-key exists on decoded refresh token. Open

Difficulty 2/5 1-3 hours Newbie friendliness 52/100

thephpleague/oauth2-server#1501 · 2 comments · Opened Feb 20, 2026
Inconsistent Content-Type -header with lowercase t Open

Difficulty 1/5 Under an hour Newbie friendliness 45/100

thephpleague/oauth2-server#1496 · 1 comment · Opened Jan 2, 2026
Not supporting [RFC 9068] Must add issuer claim to the access token JWT! Open

Future Version Spec Compliance

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#1434 · 3 comments · 3 reactions · Opened Aug 6, 2024
Add support for RFC8693 - token exchange Open

Future Version Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 35/100

thephpleague/oauth2-server#1315 · 5 comments · 9 reactions · Opened Nov 21, 2022
Race condition when issuing access token from authorization code Open

Spec Compliance

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#1306 · 3 comments · 2 reactions · Opened Oct 11, 2022
Allow Ecdsa keys as oauth2 server Open

Future Version Improvement Idea

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#1291 · 2 comments · 5 reactions · Opened Aug 11, 2022
Inappropriate error code 'unsupported_grant_type' during authorization request Open

Spec Compliance

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

thephpleague/oauth2-server#1216 · 2 comments · Opened Apr 20, 2021
Remove backwards compatibility hack for JWT aud Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

thephpleague/oauth2-server#1155 · 3 comments · Opened Nov 24, 2020
Pass JWT Config Item Open

Difficulty 4/5 3-5 days Newbie friendliness 30/100

thephpleague/oauth2-server#1154 · 7 reactions · Opened Nov 24, 2020
Race condition in file permission Open

Bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#1152 · 7 comments · Opened Nov 21, 2020
Wrong warning about public key permissions Open

Difficulty 2/5 1-3 hours Newbie friendliness 42/100

thephpleague/oauth2-server#1118 · 2 comments · Opened May 29, 2020
Question on refresh token scopes Open

Spec Compliance

Difficulty 5/5 Over a week Newbie friendliness 20/100

thephpleague/oauth2-server#1117 · 1 comment · 4 reactions · Opened May 28, 2020
Return Type Inconsistency Open

Future Version

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#1056 · Opened Oct 2, 2019
No redirect for some AuthCodeGrant::validateAuthorizationRequest errors Open

Spec Compliance

Difficulty 3/5 1-2 days Newbie friendliness 45/100

thephpleague/oauth2-server#1039 · 4 comments · Opened Jul 24, 2019
Accept key content directly instead of require a key file Open

Future Version Improvement Idea

Difficulty 4/5 3-5 days Newbie friendliness 38/100

thephpleague/oauth2-server#1007 · 10 comments · 6 reactions · Opened May 9, 2019
Refresh token handling Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#1005 · 7 comments · 2 reactions · Opened Mar 28, 2019
Outsource AbstractGrant::generateUniqueIdentifier Open

Future Version

Difficulty 5/5 Over a week Newbie friendliness 30/100

thephpleague/oauth2-server#991 · 12 comments · 1 reaction · Opened Jan 30, 2019
Error Response is not OAuth2 compliant Open

Future Version Spec Compliance

Difficulty 3/5 1-2 days Newbie friendliness 30/100

thephpleague/oauth2-server#958 · 11 comments · 5 reactions · Opened Oct 30, 2018
Restrict Characters for a Scope Open

Spec Compliance

Difficulty 3/5 1-2 days Newbie friendliness 42/100

thephpleague/oauth2-server#956 · Opened Oct 18, 2018
Indefinite Refresh Tokens Open

Needs Verification

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#946 · 5 comments · Opened Sep 20, 2018
PSR-15 version Open

Future Version Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 15/100

thephpleague/oauth2-server#942 · 2 comments · 1 reaction · Opened Sep 16, 2018
Additional Token handling after AuthorizatonServer::respondToAccessTokenRequest Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#937 · 8 comments · Opened Sep 1, 2018
Dynamic Client Registration Open

Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#934 · 3 comments · 10 reactions · Opened Aug 24, 2018
Alternative Fragment Identifier Open

Spec Compliance

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#929 · 5 comments · Opened Aug 7, 2018
Public Key vs Encryption Key Open

Documentation

Difficulty 3/5 1-2 days Newbie friendliness 42/100

thephpleague/oauth2-server#915 · 2 comments · Opened Jun 19, 2018
Password grant for SPA's Open

Documentation

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

thephpleague/oauth2-server#889 · 29 comments · 6 reactions · Opened Apr 17, 2018
Ability to extend the JWT token with information Open

Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#885 · 18 comments · 24 reactions · Opened Apr 10, 2018
BearerTokenValidator:validateAuthorization seems to incorrectly use the audience claim. Open

Future Version Spec Compliance

Difficulty 4/5 3-5 days Newbie friendliness 45/100

thephpleague/oauth2-server#857 · 9 comments · Opened Feb 18, 2018
Token Revocation question Open

Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#806 · 14 comments · 3 reactions · Opened Oct 31, 2017
ClientRepositoryInterface::getClientEntity return signature is wrong. Open

Improvement Idea

Difficulty 3/5 1-2 days Newbie friendliness 35/100

thephpleague/oauth2-server#799 · 7 comments · Opened Oct 25, 2017
MySQL schema for v6 Open

Improvement Idea

Difficulty 3/5 1-2 days Newbie friendliness 25/100

thephpleague/oauth2-server#794 · 5 comments · 7 reactions · Opened Oct 11, 2017
Return `scope` as a token response param Open

Spec Compliance

Difficulty 4/5 3-5 days Newbie friendliness 30/100

thephpleague/oauth2-server#793 · 6 comments · Opened Oct 11, 2017
Response code when `Authorization` header or `client_id` is missing Open

Difficulty 3/5 1-2 days Newbie friendliness 38/100

thephpleague/oauth2-server#792 · Opened Oct 6, 2017
Change AccessTokenRepositoryInterface to accept the complete token instead of just tokenID. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#782 · 4 comments · Opened Aug 27, 2017
Add custom encoders for token ID and refresh token, not just bin2hex Open

Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#765 · 2 comments · Opened Jul 18, 2017
How can I translate the return messages? Open

Improvement Idea

Difficulty 4/5 3-5 days Newbie friendliness 18/100

thephpleague/oauth2-server#747 · 4 comments · Opened Jun 30, 2017
RSA_KEY_PATTERN in CryptKey.php not working? Open

Difficulty 2/5 1-3 hours Newbie friendliness 38/100

thephpleague/oauth2-server#740 · 11 comments · Opened May 17, 2017
WWW-Authenticate header is not included for access denied errors Open

Difficulty 3/5 1-2 days Newbie friendliness 42/100

thephpleague/oauth2-server#738 · 3 reactions · Opened May 2, 2017
AuthorizationValidatorInterface should have setPublicKey method or ResourceServer should not call AuthorizationValidatorInterface::setPublicKey Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

thephpleague/oauth2-server#734 · Opened Apr 19, 2017
Passing expiration timestamp before revoking access/refresh tokens Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#716 · 4 comments · Opened Mar 17, 2017
AccessTokenEntityInterface::getNewToken() and scopes parameter. Open

Bug

Difficulty 2/5 1-3 hours Newbie friendliness 25/100

thephpleague/oauth2-server#715 · 4 comments · Opened Mar 17, 2017
Feature Request: key_type: pop Open

Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 20/100

thephpleague/oauth2-server#695 · Opened Jan 23, 2017
Validating scopes after user approval in the AuthCode Flow? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#659 · 1 comment · Opened Sep 20, 2016
Making refresh tokens optional Open

Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 25/100

thephpleague/oauth2-server#649 · 16 comments · Opened Aug 31, 2016
Issue with authorization code flow redirect response "code" parameter length Open

Improvement Idea

Difficulty 5/5 Over a week Newbie friendliness 35/100

thephpleague/oauth2-server#647 · 5 comments · Opened Aug 31, 2016
Split AccessTokenRepositoryInterface Open

Future Version Improvement Idea

Difficulty 4/5 3-5 days Newbie friendliness 45/100

thephpleague/oauth2-server#646 · 3 comments · Opened Aug 30, 2016
Auth Code check falls back to server var rather than raw header Open

Difficulty 3/5 1-2 days Newbie friendliness 25/100

thephpleague/oauth2-server#627 · 2 comments · Opened Jul 20, 2016

thephpleague/oauth2-server

Get new issues in your inbox