Skip to content

1.0.0 - OnPay OAuth 2.0 provider

Choose a tag to compare

View all tags
@tomsommer tomsommer released this 07 Sep 16:51
· 3 commits to master since this release
1.0.0
d2bc7bc

First release. OnPay.io OAuth 2.0 support for the PHP League's OAuth 2.0 Client.

composer require tomsommer/oauth2-onpay

Extracted from tomsommer/onpay-php-sdk, where it was an internal detail and undiscoverable to anyone integrating OnPay who does not want the whole API client.

What it covers

  • Authorization code and refresh token grants against manage.onpay.io / api.onpay.io.
  • Optional gatewayId, which scopes the authorization endpoint to a single gateway. Validated as uppercase alphanumeric, since older gateway ids are numeric and newer ones are not.
  • Overridable hosts via baseAuthorizeUri and baseUri, for test environments.
  • Opt-in PKCE (pkceMethod), off by default because the verifier has to survive the redirect and only the calling application can store it.
  • getAuthenticatedRequest() presents the token as Authorization: Bearer ….
  • OnPay's errors[].message envelope is unwrapped into IdentityProviderException, falling back to error_description, then error, then the HTTP reason phrase.

Two things about OnPay's OAuth worth stating plainly

  • There is no client secret. OnPay issues public clients only.
  • There is no resource owner endpoint. An access token authorizes a gateway, not a person, so getResourceOwner() and getResourceOwnerDetailsUrl() throw BadMethodCallException rather than inventing an endpoint, and there is no ACCESS_TOKEN_RESOURCE_OWNER_ID.

Tested on PHP 8.2, 8.3 and 8.4, against lowest and highest dependencies, with PHPStan at level 6.

Assets 2
Loading