Laravel SSO is a self-hosted identity provider rather than a package bolted onto an existing application. You create a project from the starter kit, configure the issuer, generate signing keys and run it as its own Laravel application. Services that connect to it can use any maintained OpenID Connect client library — they do not need to use Laravel or PHP.
laravel new my-sso --using=lauroguedes/laravel-sso
🔐 Protocol surface
Laravel Passport provides the OAuth 2.0 foundation; the application owns the OpenID Connect layer for discovery, the published key set, ID Tokens, UserInfo, introspection, revocation and RP-initiated logout.
- PKCE for public clients
noncecarried from the authorization request into the ID Tokenauth_time,max_ageand login prompts tied to the user's real session- Remembered consent with configurable scope descriptions
- Token introspection and revocation
- Logout with validated post-logout redirects
The scope is deliberate: no SAML, LDAP, identity brokering or federation between providers.
🧩 Applications and access boundaries
Applications are registered through the administration interface. Each owns its redirect URIs, scopes, roles, managers and user access. Tokens carry only the roles a person holds in the application requesting them, so one application never learns about another. Client secrets are shown once and stored as hashes; redirect URIs are matched exactly.
🛠️ Running the service
- User accounts, email verification, password resets, passkeys and two-factor authentication
- Browser sessions and issued tokens, with individual revocation
- Application managers and scoped delegation
- Audit records for administrative and security activity
- Branding, colors, layout, consent wording and policy links
The installer generates signing keys, creates the platform roles, optionally creates the first administrator and prints the endpoints relying applications need. Full documentation ships with the application at /docs.
🧱 Stack & validation
Laravel 13, PHP 8.3+, Passport 13, Inertia 3, Vue 3, Tailwind CSS 4 and Pest 5, on SQLite, MySQL, MariaDB or PostgreSQL. The v2.0.0 release is covered by 514 tests; CI runs the suite on SQLite, repeats it against MySQL and PostgreSQL, and performs a production-style installation without development packages.
