PHP Class for Social login: Login using credentials from a social site such as Facebook

This package can authenticate users using Facebook, Twitter or Google.

It can perform OAuth authentication of a user redirecting to either Facebook, Twitter or Google authorization pages.

If the user is successfully authenticated with any of these OAuth providers, session variables will be set with the user profile details.

This class can authorize the access of users to an API using the OAuth protocol.

It abstracts OAuth1 (1.0 and 1.0a) and OAuth2 in the same class, so you can use the same code to authorize the access on behalf of the current user any API that supports any version of the OAuth protocol.

It works on Linux, Windows and any other platform without the PECL PHP OAuth extension.

The access tokens are stored by default in session variables, but there are sub-classes specialized in storing the tokens in database tables, files or cookies.

It provides built-in support to several popular OAuth servers, so you do not have to configure the class manually with all OAuth server specific details.

Currently it provides built-in support for many OAuth servers. Every other OAuth server is supported setting end point URLs and other parameters using specific class variables. Additional servers may be supported without changing the main class by configuring a separate JSON configuration file.

The class can also send requests to API using the previously obtained OAuth access token.

It also supports 2 legged API access, so it can send signed API requests that do not require user authorization.

For mobile or other applications that the user cannot be redirected back to the client application site, this class supports pin based authorization either using OAuth 1.0a or OAuth 2.0.

It can as well obtain access tokens for specific users given their user name and password or using client credentials. It supports OAuth 2.0 authorization flows authorization_code, password and client_credentials.

For servers that support offline access like Google and Box.net, the class can also verify if the access token expired and refresh the token value before sending an API call, without requiring the user presence.

For servers that support re-authentication like Facebook, the class may also force the user to enter this application password on the authorization page.

For servers that support revoking access tokens, the class supports this functionality to invalidate a previously retrieved token.

For OpenID Connect servers based on OAuth2, the class decoded and returns the id_token JSON Web Token (JWT), so applications can use the user details such as name and email returned in the id_token response.

Here is the list of OAuth servers that have built-in support and tutorial example scripts:

- 37Signals
- Amazon
- AOL
- Bitbucket
- Bitly
- Box
- Buffer
- CharterSpectrum
- CharterSpectrumQA (CharterSpectrum Quality Assurance)
- Copy
- Dailymotion
- Discogs
- Disqus
- Dropbox (Dropbox with OAuth 1.0)
- Dropbox2 (Dropbox with OAuth 2.0)
- Etsy
- Eventful
- Facebook
- Fitbit
- Flickr
- Foursquare
- Garmin
- github
- Google
- Google1 (Google with OAuth 1.0)
- iHealth
- iHealthSandbox
- imgur
- Infusionsoft
- Instagram
- Intuit
- Jawbone
- LinkedIn
- LinkedIn2 (LinkedIn with OAuth 2.0)
- mail.ru
- MailChimp
- Mavenlink
- Meetup
- Microsoft
- Misfit
- oDesk
- Odnoklassniki
- Paypal
- PaypalApplication
- Pinterest
- Pipedrive
- Polar
- Quire
- Rdio
- Reddit
- RunKeeper
- Salesforce
- Scoop.it
- StockTwits
- SurveyMonkey
- TeamViewer
- Tumblr
- Twitter
- Vimeo
- VK
- Withings
- Wordpress
- Xero
- XING
- Yahoo
- Yahoo2
- Yammer
- Yandex