OAuth2

Quick Introduction

OAuth2 is a single PHP idea you'll use in almost every backend project.

In this lesson you learn only oauth2 — not five topics at once. By the end you can write a small working example and explain it in an interview.

We connect each lesson to our course projects: Login System, Blog CMS, REST API, Inventory, Employee Management, and E-Commerce Backend.

Business Problem

You're building the REST API. After a user signs in, you need oauth2 working correctly before storing data or showing a dashboard.

Without understanding OAuth2, the team ships bugs: wrong totals, broken sessions, or type errors that only appear in production. This lesson fixes that with one clear pattern you can copy into your project today.

Core Concept

• OAuth2 is one focused idea — learn it before mixing with other PHP topics.
• Use it in PHP 8.3+ with declare(strict_types=1); at the top of every file.
• Our course project (REST API) uses oauth2 in real handlers.
• Run small scripts with php file.php after each change — don't just read.
• Interviewers ask for a one-minute explanation plus a tiny code sample.

Syntax

Core syntax for OAuth2. Every keyword below appears in production PHP — Laravel and Symfony use the same primitives under the hood.

declare(strict_types=1);

Keywords: declare · strict_types · namespace

Step-by-Step Example

Run this script locally. Change one value, run again, and watch what changes.

<?php
declare(strict_types=1);

// Authorization Code flow — token exchange (simplified)
$clientId     = getenv('OAUTH_CLIENT_ID');
$clientSecret = getenv('OAUTH_CLIENT_SECRET');
$code         = $_GET['code'] ?? '';

$ch = curl_init('https://auth.example.com/oauth/token');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POSTFIELDS     => http_build_query([
        'grant_type'    => 'authorization_code',
        'code'          => $code,
        'client_id'     => $clientId,
        'client_secret' => $clientSecret,
        'redirect_uri'  => 'https://app.example.com/callback',
    ]),
]);

$response = curl_exec($ch);
/** @var array{access_token?: string, refresh_token?: string} $tokens */
$tokens = json_decode((string)$response, true, flags: JSON_THROW_ON_ERROR);
echo 'Access token: ' . substr($tokens['access_token'] ?? '', 0, 16) . '...';

Line by line

1. — part of the oauth2 example; run the file to see the result.
2. declare(strict_types=1); — turns on strict type checking for this file.
3. $clientId = getenv('OAUTH_CLIENT_ID'); — part of the oauth2 example; run the file to see the result.
4. $clientSecret = getenv('OAUTH_CLIENT_SECRET'); — part of the oauth2 example; run the file to see the result.
5. $code = $_GET['code'] ?? ''; — part of the oauth2 example; run the file to see the result.

{"status":"ok"}

Real-World Example

In the REST API, oauth2 appears in a single request handler — not spread across ten files. Keep the example small, test it with php, then paste the pattern into your project branch.

<?php
declare(strict_types=1);

// TODO: OAuth2 exercise for REST API