This module provides an OAuth 2.0 authorization server for Drupal, allowing secure delegation of access to web services. It is built upon a well-regarded PHP library and implements the OAuth 2.0 framework.
Simple OAuth is an implementation of the OAuth 2.0 Authorization Framework RFC.
Based on League\OAuth2
This module uses the fantastic PHP library OAuth 2.0 Server from The League of Extraordinary Packages. This library has become the de-facto standard for modern PHP applications and is thoroughly tested.
Recommendation
Check the official documentation on the Bearer Token Usage. And turn on SSL!.
End-of-Life Announcement: Simple OAuth 5.2
We want to inform the community that Simple OAuth 5.2 will reach End-of-Life (EOL) on December 9, 2026 (aligned with Drupal 10’s EOL). After this date, 5.2 will no longer receive updates or security fixes.
The upgrade path from 5.2 to 6.0/6.1 is currently unstable. Efforts are underway to stabilize this transition, and the community is encouraged to follow progress or contribute here: #3512143: 5.2.x -> 6.0.0 upgrade error
6.0.x breaking changes
With the 6.0.x we try to be more conform OAuth2 spec and compliant to the OAuth2 best current practices, this involves a few BC’s summarized here below:
- Implicit grant has been removed, see:
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#s... - Password Credentials grant has been removed, see:
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#s...
Ask your assistant about Simple OAuth (OAuth2) & OpenID Connect
Check compatibility with your Drupal and PHP version, maintenance and security coverage, from current release data. How it works
Depends on
Dependencies of the latest stable release
- Consumers
- options Drupal core
- path_alias Drupal core
- serialization Drupal core
Required by
14 tracked projects depend on this one
- Next.js 3,908 sites
- Simple OAuth Password Grant 2,127 sites
- Simple OAuth Revoke 164 sites
- Acquia Drupal Starter Kit Headless 93 sites
- Simple OAuth: Fallback Header 47 sites
- Simple OAuth Refresh Token Buffer 34 sites
- MCP Sentinel 17 sites
- User API 11 sites
- Views RSS Feed Authentication 11 sites
- Simple OAuth Redirect URI Wildcard 8 sites
- EzContent API - Enhanced De-coupled CMS Experience 2 sites
- JWT / Simple_Oauth Fallback
- Field Login & Simple Oauth Password Grant
- Quivers
Activity
Release Timeline
Releases
| Version | Type | Core | PHP | Release date | |
|---|---|---|---|---|---|
| 6.0.2 | Stable | 10–11 | Sep 30, 2025 | ||
| 6.0.1 | Stable | 10–11 | Sep 15, 2025 | ||
| 6.0.0 | Stable | 10–11 | Mar 7, 2025 | ||
| 6.0.0-beta10 | Pre-release | 10–11 | Feb 25, 2025 | ||
| 6.0.0-beta9 | Pre-release | 10–11 | Feb 24, 2025 | ||
| 6.0.0-beta8 | Pre-release | 10–11 | Dec 23, 2024 | ||
| 6.0.0-beta7 | Pre-release | 10–11 | Oct 7, 2024 | ||
| 6.0.0-beta6 | Pre-release | 9–10 | PHP >=7.4 | Apr 17, 2024 | |
| 5.2.5 | Stable | 9–10 | PHP >=7.4 | Nov 17, 2023 | |
| 6.0.0-beta5 | Pre-release | 9–10 | PHP >=7.4 | Oct 19, 2023 |