2.1.0 - error bodies recognised regardless of status

checkResponse() was gated on the HTTP status, so a 200 carrying {"error":...} — or no access_token at all — went straight to league's AccessToken constructor and failed there as an InvalidArgumentException. A caller catching IdentityProviderException, as the documentation tells you to, never saw it.

A token endpoint is entitled to report a failure with a 200, and OnPay sometimes does. An error body is now treated as a failure whatever status carries it.

The message is also stringified. IdentityProviderException takes a string, so a body with an array or object where the message belongs turned a failed grant into a TypeError.

2.0.0 - namespace renamed to TomSommer

Renames the PHP namespace from Tomsommer\OAuth2\Client\Provider to TomSommer\OAuth2\Client\Provider.

Nothing else changed. The Packagist package name stays tomsommer/oauth2-onpay, since vendor names there are lowercase.

Upgrading

-use Tomsommer\OAuth2\Client\Provider\OnPay;
+use TomSommer\OAuth2\Client\Provider\OnPay;

Composer matches PSR-4 prefixes case-sensitively, so code importing the old spelling stops autoloading rather than degrading quietly. That is why a cosmetic rename is a major version.

1.0.0 - OnPay OAuth 2.0 provider

First release. OnPay.io OAuth 2.0 support for the PHP League's OAuth 2.0 Client.

composer require tomsommer/oauth2-onpay

Extracted from tomsommer/onpay-php-sdk, where it was an internal detail and undiscoverable to anyone integrating OnPay who does not want the whole API client.

What it covers

• Authorization code and refresh token grants against manage.onpay.io / api.onpay.io.
• Optional gatewayId, which scopes the authorization endpoint to a single gateway. Validated as uppercase alphanumeric, since older gateway ids are numeric and newer ones are not.
• Overridable hosts via baseAuthorizeUri and baseUri, for test environments.
• Opt-in PKCE (pkceMethod), off by default because the verifier has to survive the redirect and only the calling application can store it.
• getAuthenticatedRequest() presents the token as Authorization: Bearer ….
• OnPay's errors[].message envelope is unwrapped into IdentityProviderException, falling back to error_description, then error, then the HTTP reason phrase.

Two things about OnPay's OAuth worth stating plainly

• There is no client secret. OnPay issues public clients only.
• There is no resource owner endpoint. An access token authorizes a gateway, not a person, so getResourceOwner() and getResourceOwnerDetailsUrl() throw BadMethodCallException rather than inventing an endpoint, and there is no ACCESS_TOKEN_RESOURCE_OWNER_ID.

Tested on PHP 8.2, 8.3 and 8.4, against lowest and highest dependencies, with PHPStan at level 6.