JWT / Simple_Oauth Fallback

Features

The JWT and Simple OAuth modules both authenticate a request by reading a
bearer token from the Authorization header, and each registers a
global authentication provider that claims any request
carrying one:

Drupal's AuthenticationManager invokes only the single
highest-priority provider whose applies() returns
TRUE — there is no fallback to the next one. Because
jwt_auth outranks oauth2 and claims every bearer
request, a valid Simple OAuth access token is handed to the JWT provider,
which cannot decode it and returns NULL. The request then
continues as anonymous, so the API responds 403 instead of
401 and the token appears to be silently ignored.

This module makes JWT and OAuth2 bearer tokens work on the same endpoints. It:

• Registers a single replacement provider that, on a bearer request, tries
  the JWT provider and then the Simple OAuth provider in turn and returns the
  first account either one produces;
• Removes the authentication_provider tag from the original
  jwt_auth and oauth2 services so they no longer
  compete, while leaving both service objects registered and unchanged for
  every other consumer (token issuing, signing and validation are untouched);
• Still enforces each route's _auth allowlist against the
  mechanism that actually authenticated the request, so a token is never
  accepted on a route that excludes its own mechanism;

Use it when a single Drupal site exposes APIs that must
accept both token types on shared routes — for example a decoupled front end
that authenticates end users with JWT while server-to-server integrations use
Simple OAuth client-credentials tokens, or a site migrating from one module
to the other that needs both honoured during the transition. If you only ever
issue one kind of bearer token, you do not need this module.

Post-Installation

There is no configuration UI, no config page, no new content type or
permission. Enabling the module is sufficient; uninstalling it fully restores
Drupal's default behaviour.

Additional Requirements

Beyond Drupal core, this module requires two contributed modules:

• JWT (jwt)
• Simple OAuth (simple_oauth)

No external PHP libraries, services or APIs are needed on top of what those
two modules already require. Supports Drupal 10 and 11.