Download the PHP package cakedc/cakephp-oauth-server without Composer

On this page you can find all versions of the php package cakedc/cakephp-oauth-server. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of cakedc/cakephp-oauth-server

Informations about the package cakephp-oauth-server

CakeDC OAuth Server for CakePHP

An OAuth 2.1 authorization server for CakePHP 5 applications. It lets AI assistants (claude.ai, Claude Code, other MCP clients) and your own programs get access tokens for your application's people. People sign in with the login your application already has, approve what a client may do on a consent page, and review or revoke their connections on a connections page.

The plugin is a thin CakePHP layer on top of cakedc/oauth-server, the framework independent core. The core does the OAuth work (endpoints, PKCE, refresh token rotation, Client ID Metadata Documents, dynamic registration, rate limits). The plugin adds what a Cake application needs: ORM storage and a migration, routes, an authenticator for cakephp/authentication, Cake views for the pages, console commands, events on Cake's event manager and a test trait. The OAuth concepts, the endpoint reference, the security model and the client setup guides live in the core's documentation, and this documentation links to them instead of repeating them.

Requirements

The floors are the oldest releases without known security advisories, which are also the oldest that current Composer installs: CakePHP before 5.1.10 and cakephp/authentication before 3.3.6 have published advisories, one of them an open redirect in the login return flow (?redirect=), the very flow the consent page sends people through.

Five minute start

  1. Install the plugin. Composer installs the core with it.

  2. Load it in src/Application.php.

  3. Create the tables.

  4. Declare the resource you protect, in config/app_local.php (one resource is enough to start). The issuer defaults to App.fullBaseUrl and the secret is derived from Security.salt.

  5. Let OAuth clients call the token endpoints, and API and MCP clients call your resources' routes, without a CSRF token (on those routes a request is skipped when it carries a bearer token of this server, or no credential at all; the CSRF cookie does not count, see installation). In Application::middleware(), after RoutingMiddleware, with the Token authenticator loaded before the session one:

  6. Check the setup.

    No line may say FAIL. A WARN is a hint (for example, that the secret is derived from Security.salt).

  7. Connect a client. The metadata document is at https://example.com/.well-known/oauth-authorization-server. To connect Claude, follow clients in the core documentation. Protect your MCP endpoint or API as described in mcp.

The consent page needs a person who is signed in. If your application has no login yet, read installation first.

Documentation

Not a CakePHP application? Use the core package cakedc/oauth-server directly.

License

MIT. See LICENSE.

All versions of cakephp-oauth-server with dependencies

PHP Build Version
Package Version
Requires php Version >=8.2
cakedc/oauth-server Version ^1.0
cakephp/authentication Version ^3.3.6
cakephp/cakephp Version ^5.1.10
cakephp/migrations Version ^4.0 || ^5.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package cakedc/cakephp-oauth-server contains the following files

Loading the files please wait ...