league/oauth2-client

Example Code

```php
<?php

require __DIR__ . '/vendor/autoload.php';

session_start();

use League\OAuth2\Client\Provider\Google;
use League\OAuth2\Client\Provider\Exception\IdentityProviderException;

// --- Configuration ---
// IMPORTANT: Replace these with your actual credentials obtained from the Google API Console.
// Make sure to register 'http://localhost:8000/oauth_callback.php' (or your actual URL)
// as an authorized redirect URI in your Google API project.
$clientId     = 'YOUR_GOOGLE_CLIENT_ID';
$clientSecret = 'YOUR_GOOGLE_CLIENT_SECRET';
$redirectUri  = 'http://localhost:8000/oauth_callback.php'; // Example local development URI

// --- Instantiate the Provider ---
// This example uses the Google provider. For other providers, use their specific classes
// or the GenericProvider for custom OAuth 2.0 services.
$provider = new Google([
    'clientId'     => $clientId,
    'clientSecret' => $clientSecret,
    'redirectUri'  => $redirectUri,
]);

// --- OAuth 2.0 Flow Logic ---
if (!isset($_GET['code'])) {
    // Phase 1: No authorization code received yet, so initiate the authorization request.
    // This block runs when the user first visits this script.

    // Generate the authorization URL and a unique state parameter to prevent CSRF.
    $authUrl = $provider->getAuthorizationUrl([
        'scope' => [
            'https://www.googleapis.com/auth/userinfo.email',
            'https://www.googleapis.com/auth/userinfo.profile'
        ]
    ]);

    // Store the state parameter in the session for later validation when the provider redirects back.
    $_SESSION['oauth2state'] = $provider->getState();

    // Redirect the user's browser to the OAuth 2.0 provider for authorization.
    header('Location: ' . $authUrl);
    exit;

} elseif (empty($_GET['state']) || (isset($_SESSION['oauth2state']) && $_GET['state'] !== $_SESSION['oauth2state'])) {
    // Phase 2: Callback from provider, but the state parameter is missing or doesn't match.
    // This indicates a potential CSRF attack or an invalid request.

    if (isset($_SESSION['oauth2state'])) {
        unset($_SESSION['oauth2state']); // Clear the stored state to prevent replay attacks.
    }
    exit('Invalid state parameter. Possible CSRF attack detected.');

} else {
    // Phase 3: Valid callback from provider with an authorization code and matching state.
    // This block runs after the user has authorized your application on the provider's site.

    try {
        // Try to exchange the authorization code for an access token.
        $accessToken = $provider->getAccessToken('authorization_code', [
            'code' => $_GET['code']
        ]);

        // --- Success: Access Token Obtained ---
        echo '<h2>OAuth 2.0 Authorization Successful!</h2>';
        echo '<h3>Access Token Details:</h3>';
        echo '<ul>';
        echo '<li>Access Token: <code>' . htmlspecialchars($accessToken->getToken()) . '</code></li>';
        if ($accessToken->getRefreshToken()) {
            echo '<li>Refresh Token: <code>' . htmlspecialchars($accessToken->getRefreshToken()) . '</code></li>';
        }
        echo '<li>Expires In: ' . htmlspecialchars($accessToken->getExpires()) . ' seconds (approx. ' . date('Y-m-d H:i:s', $accessToken->getExpires()) . ')</li>';
        echo '<li>Resource Owner ID: ' . htmlspecialchars($accessToken->getResourceOwnerId()) . '</li>';
        echo '</ul>';

        // --- Fetch User Details (Resource Owner) ---
        // Use the obtained access token to get information about the authenticated user.
        $resourceOwner = $provider->getResourceOwner($accessToken);

        echo '<h3>Resource Owner Details:</h3>';
        echo '<ul>';
        echo '<li>Name: ' . htmlspecialchars($resourceOwner->getName()) . '</li>';
        echo '<li>Email: ' . htmlspecialchars($resourceOwner->getEmail()) . '</li>';
        echo '<li>Google ID: ' . htmlspecialchars($resourceOwner->getId()) . '</li>';
        // You can access other details available in the raw response as well:
        // echo '<li>Raw Data: <pre>' . htmlspecialchars(print_r($resourceOwner->toArray(), true)) . '</pre></li>';
        echo '</ul>';

        echo '<p>You have successfully authenticated with Google. You can now use the <strong>Access Token</strong> to make API calls on behalf of the user.</p>';
        echo '<p>Remember to store the <strong>Refresh Token</strong> (if available) securely in a database to obtain new access tokens when the current one expires, without requiring user re-authorization.</p>';

    } catch (IdentityProviderException $e) {
        // --- Error: Failed to get access token or user details ---
        exit('<h3>OAuth Error:</h3><p>' . htmlspecialchars($e->getMessage()) . '</p><p>Please check your client ID, client secret, redirect URI, and network connection.</p>');
    }
}

// --- How to run this example ---
// 1. Install Composer: https://getcomposer.org/
// 2. Open your terminal in the project directory and run:
//    composer require league/oauth2-client google/oauth2-google
// 3. Create a project in Google API Console (console.developers.google.com).
// 4. Enable the 'Google People API'.
// 5. Go to 'Credentials', create 'OAuth client ID' for 'Web application'.
// 6. Set 'Authorized redirect URIs' to 'http://localhost:8000/oauth_callback.php' (or your actual URL).
// 7. Get your Client ID and Client Secret and replace the placeholders above.
// 8. Save this code as 'oauth_callback.php' (or any other name matching your redirect URI).
// 9. Serve the directory using PHP's built-in web server: `php -S localhost:8000`
// 10. Open your browser and navigate to `http://localhost:8000/oauth_callback.php`

?>
```