naf / oauth-server
Run your application as an OAuth2 authorization server and protect its APIs.
Requires
- php: >=8.3
- ext-json: *
- ext-openssl: *
- ext-pdo: *
- firebase/php-jwt: ^7.1
- naf/auth: ^0.2
- naf/form: ^0.2
- naf/framework: ^0.2
- naf/session: ^0.2
- psr/http-message: ^2.0
Requires (Dev)
- friendsofphp/php-cs-fixer: 3.95.25
- naf/cli: ^0.2
- naf/database: ^0.2
- naf/view: ^0.2
- phpstan/phpstan: ^2.1
- phpunit/phpunit: ^12.1
Suggests
- naf/cli: Generate keys and register client applications.
- naf/database: Install the OAuth schema as a migration.
- naf/view: Override the consent screen by shadowing its view.
Provides
None
Conflicts
None
Replaces
None
This package is auto-updated.
Last update: 2026-09-22 21:17:22 UTC
README
naf/oauth-server
Be the place people sign in with — an OAuth2 authorization server and OpenID Connect provider, on the accounts you already have.
token()->requireScope('posts.write');
That is the whole of what an API endpoint has to say. The authorization, the consent, the tokens and their revocation are already wired.
🧩 Part of the official NAF plugin collection. Install it when other applications should be able to act on behalf of your users.
Documentation
Everything about this package — what it does, how it is configured and what it needs — lives in the NAF documentation. Not sure which packages you need? Start here.
Install
composer require naf/oauth-server
License
MIT. Part of NAF.
PHP code style
Source, tests and PHP templates follow the shared NAF code style
(PER Coding Style 3.0 with the Nafinity readability rules). After composer install, run
composer style:check to verify formatting or composer style:fix to apply it. The formatter
is a development dependency. Review template output and run the package checks after changes.