laravel-oidc-auth-starter — Laravel Starter Template

SHA-256: 48eb959b6e7ca49d8d4dc3c5f5734e11dd99893e0e27d293e677af5ad80e373b

2026-10-14T05:04:59.785Z

# Laravel OIDC Auth Starter

Laravel authentication starter for Tuurio ID with sessions, protected routes, logout, and OpenID Connect Authorization Code flow.

[![Verify template](https://github.com/Tuurio/laravel-oidc-auth-starter/actions/workflows/verify.yml/badge.svg)](https://github.com/Tuurio/laravel-oidc-auth-starter/actions/workflows/verify.yml)

![Laravel OIDC Auth Starter social preview](.github/social-preview.png)

> Generated from [`Tuurio/auth_samples/auth_samples_laravel`](https://github.com/Tuurio/auth_samples/tree/main/auth_samples_laravel). Submit implementation fixes upstream so they are not replaced by the next synchronized release.

## What you get

- Standards-based OpenID Connect authentication with framework-native integration.
- Exact redirect and post-logout redirect handling.
- Protected-route and logout examples.
- A reviewed, pinned Tuurio provisioning workflow.

## Quickstart

1. Create a repository with **Use this template** or clone this repository.
2. Follow the framework-specific prerequisites below.
3. Review and run this pinned provisioning command:

```bash
npx [email protected] init --framework laravel --project-dir . --auth browser --yes --output json --campaign github_laravel --no-open --no-wait
```

4. Approve the exact command, then complete the secure browser handoff yourself.
5. Run the build and verify one real sign-in and sign-out.

Never paste credentials, client secrets, authorization codes, tokens, session cookies, or environment-file contents into an agent chat. Browser and native applications are public clients and must not contain a client secret.

## Runtime and verification

- Runtime: PHP 8.2+
- Package manager: Composer
- Verification: `composer install --no-interaction && cp .env.example .env && php artisan key:generate && php artisan test`

## Security model

This starter uses OpenID Connect Authorization Code flow. Browser and native clients use PKCE S256 and contain no client secret. Redirect and post-logout redirect URIs must match exactly. Identity comes from the established OIDC integration or an authenticated UserInfo request; decoded JWT payloads are never treated as validation. Keep generated local environment files ignored and never commit tokens or credentials.

## Framework instructions

# Tuurio Auth Laravel Demo

A server-rendered Laravel sample that signs in with OIDC, keeps tokens in the Laravel session, renders UserInfo, supports RP-initiated logout, and exposes a webhook endpoint with API key header validation.

## Integration guide

- Detailed integration guide: [Laravel example page](https://id.tuurio.com/public/developers/examples/laravel)
- General developer docs: [Tuurio ID developers](https://id.tuurio.com/public/developers)

## Setup

```bash
cd auth_samples_laravel
cp .env.example .env
composer install
php artisan key:generate
php artisan serve --host=127.0.0.1 --port=8000
```

Open `http://localhost:8000`.

No Node.js or Vite build step is required.

## Required client URLs

Configure your Tuurio client with these redirect URLs:

```text
Redirect URI: http://localhost:8000/auth/callback
Post-logout Redirect URI: http://localhost:8000/logout/callback
```

## `.env` keys

```env
TUURIO_ISSUER=https://<tenantId>.id.tuurio.com
TUURIO_CLIENT_ID=laravel-demo
TUURIO_CLIENT_SECRET=YOUR_CLIENT_SECRET
TUURIO_REDIRECT_URI=http://localhost:8000/auth/callback
TUURIO_POST_LOGOUT_REDIRECT_URI=http://localhost:8000/logout/callback
TUURIO_SCOPE=openid profile email
TUURIO_WEBHOOK_ID=
TUURIO_WEBHOOK_URL=
TUURIO_WEBHOOK_EDIT_URL=
TUURIO_WEBHOOK_SIGNING_SECRET=
TUURIO_WEBHOOK_LISTEN_PATH=/webhooks/tuurio
TUURIO_WEBHOOK_API_KEY_HEADER=X-Tuurio-Webhook-Key
TUURIO_WEBHOOK_API_KEY=
```

## What is included

- `/login` starts Authorization Code + PKCE
- `/auth/callback` exchanges the code and stores tokens in the Laravel session
- `/logout` calls the provider logout endpoint with `client_id + post_logout_redirect_uri`
- `/logout/callback` confirms the local session is gone
- `POST /webhooks/tuurio` validates the configured API key header and logs incoming events

## Webhook notes

- Incoming webhook payloads are logged to `storage/logs/laravel.log`
- The sample validates the configured API key header before accepting the event
- If provisioning generated a live webhook for you, the `.env` already contains the endpoint metadata

## Webhook deployment notes

- If your deployed app already has a stable public URL, set `TUURIO_WEBHOOK_URL` to that final endpoint and keep `TUURIO_WEBHOOK_LISTEN_PATH` aligned with your Laravel route.
- If you provisioned the sample before deployment and only had a placeholder domain, update the webhook endpoint in the Tuurio admin after the final URL is known.
- Keep `TUURIO_WEBHOOK_EDIT_URL` if provisioning filled it in. It points back to the webhook configuration you may need to adjust later.
- Do not expose the webhook route without checking the configured API key header. This sample expects `TUURIO_WEBHOOK_API_KEY_HEADER` and `TUURIO_WEBHOOK_API_KEY` to be set consistently with the tenant webhook configuration.


## License

Licensed under the Apache License, Version 2.0. See [`LICENSE`](./LICENSE).