Simple OAuth (OAuth2) & OpenID Connect
This module provides an OAuth 2.0 authorization server for Drupal, allowing secure delegation of access to web services. It is built upon a well-regarded PHP library and implements the OAuth 2.0 framework.
Simple OAuth is an implementation of the OAuth 2.0 Authorization Framework RFC.
Based on League\OAuth2
This module uses the fantastic PHP library OAuth 2.0 Server from The League of Extraordinary Packages. This library has become the de-facto standard for modern PHP applications and is thoroughly tested.
Recommendation
Check the official documentation on the Bearer Token Usage. And turn on SSL!.
End-of-Life Announcement: Simple OAuth 5.2
We want to inform the community that Simple OAuth 5.2 will reach End-of-Life (EOL) on December 9, 2026 (aligned with Drupal 10’s EOL). After this date, 5.2 will no longer receive updates or security fixes.
The upgrade path from 5.2 to 6.0/6.1 is currently unstable. Efforts are underway to stabilize this transition, and the community is encouraged to follow progress or contribute here: #3512143: 5.2.x -> 6.0.0 upgrade error
6.0.x breaking changes
With the 6.0.x we try to be more conform OAuth2 spec and compliant to the OAuth2 best current practices, this involves a few BC’s summarized here below:
- Implicit grant has been removed, see:
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#s... - Password Credentials grant has been removed, see:
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#s...
Depends on
Dependencies of the latest stable release
- Consumers
- options Drupal core
- path_alias Drupal core
- serialization Drupal core
Required by
11 tracked projects depend on this one
- Next.js 3,423 sites
- Simple OAuth Password Grant 1,942 sites
- Simple OAuth Revoke 140 sites
- Acquia Drupal Starter Kit Headless 88 sites
- Simple OAuth: Fallback Header 53 sites
- Simple OAuth Refresh Token Buffer 32 sites
- User API 12 sites
- Views RSS Feed Authentication 8 sites
- MCP Sentinel 6 sites
- Simple OAuth Redirect URI Wildcard 4 sites
- EzContent API - Enhanced De-coupled CMS Experience 2 sites
Activity
Release Timeline
Releases
| Version | Type | Core | Notes | Release date | |
|---|---|---|---|---|---|
| 6.1.1 | Stable | 10–11 | May 22, 2026 | ||
| 6.1.x-dev | Dev | 10–11 | Dec 8, 2025 | ||
| 6.1.0 | Stable | 10–11 | Cache context & access policy support | Dec 8, 2025 | |
| 6.0.9 | Stable | 10–11 | Nov 3, 2025 | ||
| 6.0.8 | Stable | 10–11 | Oct 30, 2025 | ||
| 6.0.7 | Stable | 10–11 | Oct 29, 2025 | ||
| 6.0.6 | Stable | 10–11 | Oct 28, 2025 | ||
| 6.0.5 | Stable | 10–11 | Oct 23, 2025 | ||
| 6.0.4 | Stable | 10–11 | Oct 21, 2025 | ||
| 6.0.3 | Stable | 10–11 | Oct 15, 2025 | ||
| 6.0.2 | Stable | 10–11 | Sep 30, 2025 | ||
| 6.0.1 | Stable | 10–11 | Sep 15, 2025 | ||
| 6.0.0 | Stable | 10–11 | Mar 7, 2025 | ||
| 6.0.0-beta10 | Pre-release | 10–11 | Feb 25, 2025 | ||
| 6.0.0-beta9 | Pre-release | 10–11 | Feb 24, 2025 | ||
| 6.0.0-beta8 | Pre-release | 10–11 | Dec 23, 2024 | ||
| 6.0.0-beta7 | Pre-release | 10–11 | Drupal 11 compatibility | Oct 7, 2024 |