Download the PHP package deadmantfa/yii2-oauth2-server without Composer

Yii2 OAuth2 Server (PHP 8+ & League v9 Ready)

This is a fork of the original chervand/yii2-oauth2-server plugin, updated for PHP 8+, league/oauth2-server ^9.1, and additional custom grants (including optional support for MAC tokens, token revocation, and more).

It provides:

• A standards-compliant OAuth2.0 Server for Yii2
• Refresh token support (RFC6749 / RFC7009)
• MAC token support (experimental, draft-ietf-oauth-v2-http-mac-05)
• Token revocation endpoints
• Flexible DB-based migrations for storing OAuth2 clients, tokens, scopes, etc.
• Easy integration with your Yii2 user component so you can unify login states and roles.

1. Installation

Add this package to your project:

1.1 Apply DB Migrations

Run:

This creates the default OAuth2-related tables (clients, tokens, scopes, etc.).

1.2 Generate Public & Private Keys

Follow League’s official instructions for generating private/public keys. Typically:

Store them somewhere safe (e.g. @app/oauth2/private.key, @app/oauth2/public.key).

2. Basic Configuration

Below is a simple example of how to configure the module in your config/main.php (or similar file).

That’s enough to spin up the Authorization Server portion. You’ll have endpoints like:

• (to exchange credentials for tokens)
• (to revoke a token, if you enabled RevokeGrant)

3. Integrating with Your user Component

3.1 Provide a

In League OAuth2, you need a repository that implements . Typically, you can have your user model implement and provide a method:

3.2 Linking to Your Identity in Yii2

If you want to unify your “OAuth2 user ID” with your standard Yii user identity:

1. In , set in your user component.
2. Ensure your model has returning the correct user identifier.
3. Make sure the above repository uses that same model.

4. Resource Server (Protecting Your API)

To validate tokens in your controllers, attach an authenticator that checks the header. For example:

Any requests with an invalid or no token get a 401 response.

5. MAC Tokens (Optional)

If you want MAC tokens (still a draft), you can enable them by adding:

And in your module’s , you can enable a instead of .

6. Revoke Tokens (RFC7009)

Add the in :

Then request:

The plugin revokes tokens in the DB. The next time the resource server checks that token, it’s marked invalid.

7. Optional CORS Support

If you want to handle CORS within this plugin (e.g. for /oauth2/token calls in front-end apps), you can either:

• (A) Configure CORS globally in your Yii2 app (recommended for most setups), or
• (B) Enable a built-in CORS filter inside this module’s controllers.

7.1 Sample Global CORS

In your main :

7.2 Built-in CORS in Module

If you want the plugin to handle it internally, you can define a property like:

8. Additional Notes

• For custom grants (like a or a ), implement or extend and register it in .
• You can store user IDs as UUID strings or integers. Just ensure your returns a string that the library can embed in the token.
• The library handles JWT signing/verification, so you just need to provide your private/public RSA keys.