OAuth2 Server Implementation with Laravel: Beyond the Basics

Build enterprise-grade OAuth2 authorization servers with Laravel, implementing advanced security patterns, custom flows, and multi-client architectures.

Table Of Contents

• Understanding OAuth2 Architecture in Laravel
• Advanced Authorization Server Configuration
• Device Flow Implementation
• Advanced Security Features
• Comprehensive Testing Strategy

Understanding OAuth2 Architecture in Laravel

OAuth2 is an authorization framework that enables applications to obtain limited access to user accounts on HTTP services. While Laravel Passport provides excellent OAuth2 server capabilities out of the box, enterprise applications often require sophisticated customizations for multi-client environments, advanced security patterns, and complex authorization workflows.

Building a robust OAuth2 server goes beyond basic token issuance. It involves implementing proper client management, secure token handling, comprehensive audit logging, and flexible authorization policies that can adapt to complex business requirements. This is essential when creating API-driven applications with Laravel.

Advanced Authorization Server Configuration

Custom Authorization Server Setup

Create a sophisticated authorization server with enhanced security features:

<?php

namespace App\OAuth2;

use League\OAuth2\Server\AuthorizationServer;
use League\OAuth2\Server\Grant\AuthCodeGrant;
use League\OAuth2\Server\Grant\ClientCredentialsGrant;
use League\OAuth2\Server\Grant\RefreshTokenGrant;
use App\OAuth2\Grants\DeviceCodeGrant;
use App\OAuth2\Grants\PKCEAuthCodeGrant;
use App\OAuth2\Repositories\AccessTokenRepository;
use App\OAuth2\Repositories\ClientRepository;
use App\OAuth2\Repositories\ScopeRepository;
use App\OAuth2\Repositories\RefreshTokenRepository;
use App\OAuth2\Repositories\AuthCodeRepository;

class EnhancedAuthorizationServer
{
    protected AuthorizationServer $server;
    protected array $grantTypes = [];
    
    public function __construct()
    {
        $this->server = new AuthorizationServer(
            app(ClientRepository::class),
            app(AccessTokenRepository::class),
            app(ScopeRepository::class),
            $this->getPrivateKey(),
            $this->getEncryptionKey()
        );
        
        $this->configureGrantTypes();
        $this->configureMiddleware();
    }
    
    protected function configureGrantTypes(): void
    {
        // Authorization Code Grant with PKCE
        $authCodeGrant = new PKCEAuthCodeGrant(
            app(AuthCodeRepository::class),
            app(RefreshTokenRepository::class),
            new \DateInterval('PT10M') // 10 minutes
        );
        $authCodeGrant->setRefreshTokenTTL(new \DateInterval('P1M')); // 1 month
        $authCodeGrant->enableCodeExchangeProof();
        
        $this->server->enableGrantType(
            $authCodeGrant,
            new \DateInterval('PT1H') // 1 hour access token
        );
        
        // Client Credentials Grant for server-to-server
        $clientCredentialsGrant = new ClientCredentialsGrant();
        $this->server->enableGrantType(
            $clientCredentialsGrant,
            new \DateInterval('PT2H') // 2 hours access token
        );
        
        // Refresh Token Grant
        $refreshTokenGrant = new RefreshTokenGrant(app(RefreshTokenRepository::class));
        $refreshTokenGrant->setRefreshTokenTTL(new \DateInterval('P1M'));
        
        $this->server->enableGrantType(
            $refreshTokenGrant,
            new \DateInterval('PT1H')
        );
        
        // Device Code Grant for IoT/TV applications
        $deviceCodeGrant = new DeviceCodeGrant(
            app(DeviceCodeRepository::class),
            app(RefreshTokenRepository::class),
            new \DateInterval('PT10M') // 10 minutes device code TTL
        );
        
        $this->server->enableGrantType(
            $deviceCodeGrant,
            new \DateInterval('PT1H')
        );
    }
    
    protected function configureMiddleware(): void
    {
        // Add custom middleware for request/response logging
        $this->server->setDefaultScope('basic');
        
        // Configure token endpoint response type
        $this->server->setEncryptionKey($this->getEncryptionKey());
    }
    
    protected function getPrivateKey(): \League\OAuth2\Server\CryptKey
    {
        return new \League\OAuth2\Server\CryptKey(
            storage_path('oauth-private.key'),
            config('passport.private_key_passphrase'),
            false
        );
    }
    
    protected function getEncryptionKey(): string
    {
        return config('passport.encryption_key', base64_decode(config('app.key')));
    }
    
    public function getServer(): AuthorizationServer
    {
        return $this->server;
    }
}

PKCE Implementation

Implement Proof Key for Code Exchange for enhanced security:

<?php

namespace App\OAuth2\Grants;

use League\OAuth2\Server\Grant\AuthCodeGrant;
use League\OAuth2\Server\Exception\OAuthServerException;
use League\OAuth2\Server\RequestEvent;
use Psr\Http\Message\ServerRequestInterface;

class PKCEAuthCodeGrant extends AuthCodeGrant
{
    protected bool $requireCodeChallenge = true;
    
    public function enableCodeExchangeProof(): void
    {
        $this->requireCodeChallenge = true;
    }
    
    protected function validateAuthorizationRequest(ServerRequestInterface $request)
    {
        $authRequest = parent::validateAuthorizationRequest($request);
        
        // PKCE validation for public clients
        if ($this->isPublicClient($authRequest->getClient())) {
            $this->validatePKCEParameters($request);
            
            // Store code challenge for later verification
            $authRequest->setCodeChallenge(
                $this->getQueryStringParameter('code_challenge', $request)
            );
            $authRequest->setCodeChallengeMethod(
                $this->getQueryStringParameter('code_challenge_method', $request, 'plain')
            );
        }
        
        return $authRequest;
    }
    
    protected function validatePKCEParameters(ServerRequestInterface $request): void
    {
        $codeChallenge = $this->getQueryStringParameter('code_challenge', $request);
        $codeChallengeMethod = $this->getQueryStringParameter('code_challenge_method', $request, 'plain');
        
        if (!$codeChallenge) {
            throw OAuthServerException::invalidRequest('code_challenge', 'PKCE code challenge is required for public clients');
        }
        
        if (!in_array($codeChallengeMethod, ['plain', 'S256'])) {
            throw OAuthServerException::invalidRequest('code_challenge_method', 'Invalid code challenge method');
        }
        
        // Validate code challenge format
        if ($codeChallengeMethod === 'S256') {
            if (!preg_match('/^[A-Za-z0-9\-._~]{43,128}$/', $codeChallenge)) {
                throw OAuthServerException::invalidRequest('code_challenge', 'Invalid code challenge format');
            }
        }
    }
    
    protected function validateCodeVerifier(string $codeVerifier, string $codeChallenge, string $method): bool
    {
        switch ($method) {
            case 'plain':
                return hash_equals($codeChallenge, $codeVerifier);
                
            case 'S256':
                $hash = hash('sha256', $codeVerifier, true);
                $expectedChallenge = rtrim(strtr(base64_encode($hash), '+/', '-_'), '=');
                return hash_equals($codeChallenge, $expectedChallenge);
                
            default:
                return false;
        }
    }
    
    protected function isPublicClient($client): bool
    {
        // Determine if client is public (can't securely store secrets)
        return $client->isConfidential() === false;
    }
}

Device Flow Implementation

Device Authorization Grant

Implement device flow for IoT and limited-input devices:

<?php

namespace App\OAuth2\Grants;

use League\OAuth2\Server\Grant\AbstractGrant;
use League\OAuth2\Server\Exception\OAuthServerException;
use League\OAuth2\Server\RequestEvent;
use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
use Psr\Http\Message\ServerRequestInterface;
use App\OAuth2\Repositories\DeviceCodeRepositoryInterface;

class DeviceCodeGrant extends AbstractGrant
{
    protected DeviceCodeRepositoryInterface $deviceCodeRepository;
    protected string $deviceEndpoint = '/oauth/device';
    protected int $deviceCodeTTL = 1800; // 30 minutes
    protected int $interval = 5; // 5 seconds
    
    public function __construct(
        DeviceCodeRepositoryInterface $deviceCodeRepository,
        RefreshTokenRepositoryInterface $refreshTokenRepository,
        \DateInterval $deviceCodeTTL
    ) {
        $this->deviceCodeRepository = $deviceCodeRepository;
        $this->refreshTokenRepository = $refreshTokenRepository;
        $this->deviceCodeTTL = $deviceCodeTTL->s;
    }
    
    public function respondToDeviceAuthorizationRequest(ServerRequestInterface $request): array
    {
        $client = $this->validateClient($request);
        $scopes = $this->validateScopes($this->getRequestParameter('scope', $request, ''));
        
        // Generate device code and user code
        $deviceCode = $this->generateUniqueIdentifier();
        $userCode = $this->generateUserCode();
        
        // Store device authorization
        $this->deviceCodeRepository->persistNewDeviceCode(
            $deviceCode,
            $userCode,
            $client->getIdentifier(),
            $scopes,
            new \DateTime('+' . $this->deviceCodeTTL . ' seconds')
        );
        
        return [
            'device_code' => $deviceCode,
            'user_code' => $userCode,
            'verification_uri' => config('app.url') . '/device',
            'verification_uri_complete' => config('app.url') . '/device?user_code=' . $userCode,
            'expires_in' => $this->deviceCodeTTL,
            'interval' => $this->interval,
        ];
    }
    
    public function respondToAccessTokenRequest(
        ServerRequestInterface $request,
        ResponseTypeInterface $responseType,
        \DateInterval $accessTokenTTL
    ): ResponseTypeInterface {
        $client = $this->validateClient($request);
        $deviceCode = $this->getRequestParameter('device_code', $request);
        
        if (!$deviceCode) {
            throw OAuthServerException::invalidRequest('device_code');
        }
        
        // Validate device code
        $deviceAuth = $this->deviceCodeRepository->getDeviceCode($deviceCode, $client->getIdentifier());
        
        if (!$deviceAuth) {
            throw OAuthServerException::invalidGrant('Device code not found or expired');
        }
        
        if ($deviceAuth->isExpired()) {
            $this->deviceCodeRepository->revokeDeviceCode($deviceCode);
            throw OAuthServerException::invalidGrant('Device code expired');
        }
        
        if (!$deviceAuth->isAuthorized()) {
            // Check if user has denied authorization
            if ($deviceAuth->isDenied()) {
                $this->deviceCodeRepository->revokeDeviceCode($deviceCode);
                throw OAuthServerException::accessDenied('User denied authorization');
            }
            
            // Still waiting for user authorization
            throw OAuthServerException::authorizationPending();
        }
        
        // Generate access token
        $accessToken = $this->issueAccessToken(
            $accessTokenTTL,
            $client,
            $deviceAuth->getUserIdentifier(),
            $deviceAuth->getScopes()
        );
        
        // Generate refresh token
        $refreshToken = $this->issueRefreshToken($accessToken);
        
        // Clean up device code
        $this->deviceCodeRepository->revokeDeviceCode($deviceCode);
        
        $responseType->setAccessToken($accessToken);
        $responseType->setRefreshToken($refreshToken);
        
        return $responseType;
    }
    
    protected function generateUserCode(): string
    {
        // Generate user-friendly code (e.g., ABCD-EFGH)
        $characters = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
        $code = '';
        
        for ($i = 0; $i < 8; $i++) {
            if ($i === 4) {
                $code .= '-';
            }
            $code .= $characters[random_int(0, strlen($characters) - 1)];
        }
        
        // Ensure uniqueness
        if ($this->deviceCodeRepository->isUserCodeTaken($code)) {
            return $this->generateUserCode();
        }
        
        return $code;
    }
    
    public function getIdentifier(): string
    {
        return 'urn:ietf:params:oauth:grant-type:device_code';
    }
}

Device Flow Controller

Create controllers to handle device flow endpoints:

<?php

namespace App\Http\Controllers\OAuth2;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Http\JsonResponse;
use App\OAuth2\EnhancedAuthorizationServer;
use App\OAuth2\Repositories\DeviceCodeRepository;
use Psr\Http\Message\ServerRequestInterface;

class DeviceFlowController extends Controller
{
    protected EnhancedAuthorizationServer $authServer;
    protected DeviceCodeRepository $deviceCodeRepository;
    
    public function __construct(
        EnhancedAuthorizationServer $authServer,
        DeviceCodeRepository $deviceCodeRepository
    ) {
        $this->authServer = $authServer;
        $this->deviceCodeRepository = $deviceCodeRepository;
    }
    
    public function authorize(ServerRequestInterface $request): JsonResponse
    {
        try {
            $response = $this->authServer->getDeviceGrant()
                                       ->respondToDeviceAuthorizationRequest($request);
            
            return response()->json($response);
            
        } catch (\Exception $e) {
            return response()->json([
                'error' => 'invalid_request',
                'error_description' => $e->getMessage(),
            ], 400);
        }
    }
    
    public function verify(Request $request)
    {
        $userCode = $request->input('user_code');
        
        if (!$userCode) {
            return view('oauth2.device-verify', ['error' => 'User code is required']);
        }
        
        $deviceAuth = $this->deviceCodeRepository->getDeviceCodeByUserCode($userCode);
        
        if (!$deviceAuth || $deviceAuth->isExpired()) {
            return view('oauth2.device-verify', ['error' => 'Invalid or expired user code']);
        }
        
        if ($deviceAuth->isAuthorized()) {
            return view('oauth2.device-success');
        }
        
        return view('oauth2.device-verify', [
            'device_auth' => $deviceAuth,
            'user_code' => $userCode,
        ]);
    }
    
    public function approve(Request $request)
    {
        $request->validate([
            'user_code' => 'required|string',
            'action' => 'required|in:approve,deny',
        ]);
        
        $deviceAuth = $this->deviceCodeRepository->getDeviceCodeByUserCode($request->user_code);
        
        if (!$deviceAuth || $deviceAuth->isExpired()) {
            return redirect()->route('device.verify')
                           ->withErrors(['user_code' => 'Invalid or expired user code']);
        }
        
        if ($request->action === 'approve') {
            $this->deviceCodeRepository->authorizeDeviceCode(
                $deviceAuth->getDeviceCode(),
                auth()->id()
            );
            
            return view('oauth2.device-success');
        } else {
            $this->deviceCodeRepository->denyDeviceCode($deviceAuth->getDeviceCode());
            
            return view('oauth2.device-denied');
        }
    }
}

Advanced Security Features

JWT Token Introspection

Implement RFC 7662 token introspection:

<?php

namespace App\Http\Controllers\OAuth2;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Http\JsonResponse;
use Laravel\Passport\TokenRepository;
use Laravel\Passport\Token;

class TokenIntrospectionController extends Controller
{
    protected TokenRepository $tokenRepository;
    
    public function __construct(TokenRepository $tokenRepository)
    {
        $this->tokenRepository = $tokenRepository;
    }
    
    public function introspect(Request $request): JsonResponse
    {
        // Validate client credentials
        $this->validateIntrospectionClient($request);
        
        $tokenHint = $request->input('token');
        $tokenTypeHint = $request->input('token_type_hint', 'access_token');
        
        if (!$tokenHint) {
            return $this->introspectionResponse(['active' => false]);
        }
        
        $token = $this->findToken($tokenHint, $tokenTypeHint);
        
        if (!$token || $token->revoked || $token->expires_at->isPast()) {
            return $this->introspectionResponse(['active' => false]);
        }
        
        return $this->introspectionResponse([
            'active' => true,
            'scope' => implode(' ', $token->scopes),
            'client_id' => $token->client->id,
            'username' => $token->user?->email,
            'exp' => $token->expires_at->timestamp,
            'iat' => $token->created_at->timestamp,
            'sub' => $token->user_id,
            'aud' => config('app.url'),
            'iss' => config('app.url'),
            'jti' => $token->id,
            'token_type' => 'Bearer',
        ]);
    }
    
    protected function validateIntrospectionClient(Request $request): void
    {
        $clientId = $request->getUser();
        $clientSecret = $request->getPassword();
        
        if (!$clientId || !$clientSecret) {
            // Try POST body
            $clientId = $request->input('client_id');
            $clientSecret = $request->input('client_secret');
        }
        
        if (!$clientId || !$clientSecret) {
            abort(401, 'Client authentication required');
        }
        
        $client = \Laravel\Passport\Client::where('id', $clientId)->first();
        
        if (!$client || !hash_equals($client->secret, $clientSecret)) {
            abort(401, 'Invalid client credentials');
        }
        
        // Ensure client has introspection permission
        if (!$client->hasPermission('token_introspection')) {
            abort(403, 'Client not authorized for token introspection');
        }
    }
    
    protected function findToken(string $tokenHint, string $tokenTypeHint): ?Token
    {
        if ($tokenTypeHint === 'refresh_token') {
            return \Laravel\Passport\RefreshToken::where('id', $tokenHint)->first()?->accessToken;
        }
        
        // Try to find by access token ID or JWT
        return $this->tokenRepository->find($tokenHint) 
            ?? $this->findTokenByJwt($tokenHint);
    }
    
    protected function findTokenByJwt(string $jwt): ?Token
    {
        try {
            $payload = \Firebase\JWT\JWT::decode(
                $jwt,
                new \Firebase\JWT\Key(config('passport.public_key'), 'RS256')
            );
            
            return $this->tokenRepository->find($payload->jti);
            
        } catch (\Exception $e) {
            return null;
        }
    }
    
    protected function introspectionResponse(array $data): JsonResponse
    {
        return response()->json($data)
                        ->header('Cache-Control', 'no-store')
                        ->header('Pragma', 'no-cache');
    }
}

Dynamic Client Registration

Implement RFC 7591 dynamic client registration:

<?php

namespace App\Http\Controllers\OAuth2;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Http\JsonResponse;
use Laravel\Passport\ClientRepository;
use Laravel\Passport\Client;

class DynamicClientRegistrationController extends Controller
{
    protected ClientRepository $clientRepository;
    protected array $allowedGrantTypes = [
        'authorization_code',
        'client_credentials',
        'refresh_token',
        'urn:ietf:params:oauth:grant-type:device_code',
    ];
    
    public function __construct(ClientRepository $clientRepository)
    {
        $this->clientRepository = $clientRepository;
        $this->middleware('auth:api')->except(['register']);
        $this->middleware('throttle:5,1')->only(['register']);
    }
    
    public function register(Request $request): JsonResponse
    {
        $this->validateRegistrationRequest($request);
        
        $clientData = $this->prepareClientData($request);
        
        $client = $this->clientRepository->create(
            null, // No user association for dynamic clients
            $clientData['client_name'],
            $clientData['redirect_uris'],
            null,
            false,
            false,
            $clientData['token_endpoint_auth_method'] === 'client_secret_basic'
        );
        
        // Store additional metadata
        $client->update([
            'grant_types' => json_encode($clientData['grant_types']),
            'response_types' => json_encode($clientData['response_types']),
            'scope' => $clientData['scope'],
            'token_endpoint_auth_method' => $clientData['token_endpoint_auth_method'],
            'application_type' => $clientData['application_type'],
            'contacts' => json_encode($clientData['contacts'] ?? []),
            'logo_uri' => $clientData['logo_uri'] ?? null,
            'client_uri' => $clientData['client_uri'] ?? null,
            'policy_uri' => $clientData['policy_uri'] ?? null,
            'tos_uri' => $clientData['tos_uri'] ?? null,
        ]);
        
        return response()->json([
            'client_id' => $client->id,
            'client_secret' => $client->secret,
            'client_id_issued_at' => $client->created_at->timestamp,
            'client_secret_expires_at' => 0, // Never expires
            'client_name' => $client->name,
            'redirect_uris' => explode(',', $client->redirect),
            'grant_types' => $clientData['grant_types'],
            'response_types' => $clientData['response_types'],
            'scope' => $clientData['scope'],
            'token_endpoint_auth_method' => $clientData['token_endpoint_auth_method'],
        ], 201);
    }
    
    protected function validateRegistrationRequest(Request $request): void
    {
        $request->validate([
            'client_name' => 'required|string|max:255',
            'redirect_uris' => 'required|array|min:1',
            'redirect_uris.*' => 'required|url|max:2048',
            'grant_types' => 'array',
            'grant_types.*' => 'in:' . implode(',', $this->allowedGrantTypes),
            'response_types' => 'array',
            'response_types.*' => 'in:code,token',
            'scope' => 'string|max:1000',
            'contacts' => 'array',
            'contacts.*' => 'email|max:255',
            'logo_uri' => 'nullable|url|max:2048',
            'client_uri' => 'nullable|url|max:2048',
            'policy_uri' => 'nullable|url|max:2048',
            'tos_uri' => 'nullable|url|max:2048',
            'token_endpoint_auth_method' => 'in:client_secret_basic,client_secret_post,none',
            'application_type' => 'in:web,native',
        ]);
        
        // Additional validation for native apps
        if ($request->input('application_type') === 'native') {
            $this->validateNativeAppRedirectUris($request->input('redirect_uris'));
        }
    }
    
    protected function validateNativeAppRedirectUris(array $redirectUris): void
    {
        foreach ($redirectUris as $uri) {
            $scheme = parse_url($uri, PHP_URL_SCHEME);
            $host = parse_url($uri, PHP_URL_HOST);
            
            // Native apps must use custom schemes or localhost
            if (!in_array($scheme, ['http', 'https']) || $host !== 'localhost') {
                if (in_array($scheme, ['http', 'https'])) {
                    throw new \InvalidArgumentException('Native apps cannot use remote HTTP(S) redirect URIs');
                }
            }
        }
    }
    
    protected function prepareClientData(Request $request): array
    {
        return [
            'client_name' => $request->input('client_name'),
            'redirect_uris' => implode(',', $request->input('redirect_uris')),
            'grant_types' => $request->input('grant_types', ['authorization_code']),
            'response_types' => $request->input('response_types', ['code']),
            'scope' => $request->input('scope', 'basic'),
            'token_endpoint_auth_method' => $request->input('token_endpoint_auth_method', 'client_secret_basic'),
            'application_type' => $request->input('application_type', 'web'),
            'contacts' => $request->input('contacts', []),
            'logo_uri' => $request->input('logo_uri'),
            'client_uri' => $request->input('client_uri'),
            'policy_uri' => $request->input('policy_uri'),
            'tos_uri' => $request->input('tos_uri'),
        ];
    }
    
    public function update(Request $request, string $clientId): JsonResponse
    {
        // Implement client update functionality
        // Validate client ownership and update permissions
        // Return updated client information
    }
    
    public function delete(string $clientId): JsonResponse
    {
        // Implement client deletion
        // Revoke all associated tokens
        // Return confirmation
    }
}

Comprehensive Testing Strategy

OAuth2 Flow Testing

Create comprehensive tests for OAuth2 flows:

<?php

namespace Tests\Feature\OAuth2;

use Tests\TestCase;
use Laravel\Passport\Client;
use App\Models\User;
use Illuminate\Support\Facades\Hash;

class OAuth2FlowTest extends TestCase
{
    protected Client $client;
    protected User $user;
    
    protected function setUp(): void
    {
        parent::setUp();
        
        $this->client = Client::factory()->create([
            'secret' => Hash::make('client-secret'),
            'redirect' => 'https://example.com/callback',
        ]);
        
        $this->user = User::factory()->create();
    }
    
    public function test_authorization_code_flow_with_pkce(): void
    {
        $codeVerifier = $this->generateCodeVerifier();
        $codeChallenge = $this->generateCodeChallenge($codeVerifier);
        
        // Step 1: Authorization request
        $response = $this->actingAs($this->user)
                        ->get('/oauth/authorize?' . http_build_query([
                            'client_id' => $this->client->id,
                            'redirect_uri' => $this->client->redirect,
                            'response_type' => 'code',
                            'scope' => 'basic',
                            'code_challenge' => $codeChallenge,
                            'code_challenge_method' => 'S256',
                            'state' => 'random-state',
                        ]));
        
        $response->assertStatus(200);
        
        // Step 2: User approves authorization
        $response = $this->actingAs($this->user)
                        ->post('/oauth/authorize', [
                            'client_id' => $this->client->id,
                            'redirect_uri' => $this->client->redirect,
                            'response_type' => 'code',
                            'scope' => 'basic',
                            'code_challenge' => $codeChallenge,
                            'code_challenge_method' => 'S256',
                            'state' => 'random-state',
                            'approve' => true,
                        ]);
        
        $response->assertRedirect();
        $location = $response->headers->get('Location');
        
        // Extract authorization code
        parse_str(parse_url($location, PHP_URL_QUERY), $query);
        $authCode = $query['code'];
        
        // Step 3: Exchange code for token
        $response = $this->post('/oauth/token', [
            'grant_type' => 'authorization_code',
            'client_id' => $this->client->id,
            'client_secret' => 'client-secret',
            'redirect_uri' => $this->client->redirect,
            'code' => $authCode,
            'code_verifier' => $codeVerifier,
        ]);
        
        $response->assertStatus(200);
        $tokenData = $response->json();
        
        $this->assertArrayHasKey('access_token', $tokenData);
        $this->assertArrayHasKey('refresh_token', $tokenData);
        $this->assertEquals('Bearer', $tokenData['token_type']);
    }
    
    public function test_device_code_flow(): void
    {
        // Step 1: Device authorization request
        $response = $this->post('/oauth/device', [
            'client_id' => $this->client->id,
            'scope' => 'basic',
        ]);
        
        $response->assertStatus(200);
        $deviceData = $response->json();
        
        $this->assertArrayHasKey('device_code', $deviceData);
        $this->assertArrayHasKey('user_code', $deviceData);
        $this->assertArrayHasKey('verification_uri', $deviceData);
        
        // Step 2: User visits verification URI and approves
        $this->actingAs($this->user)
             ->post('/device/approve', [
                 'user_code' => $deviceData['user_code'],
                 'action' => 'approve',
             ])
             ->assertViewIs('oauth2.device-success');
        
        // Step 3: Device polls for token
        $response = $this->post('/oauth/token', [
            'grant_type' => 'urn:ietf:params:oauth:grant-type:device_code',
            'client_id' => $this->client->id,
            'device_code' => $deviceData['device_code'],
        ]);
        
        $response->assertStatus(200);
        $tokenData = $response->json();
        
        $this->assertArrayHasKey('access_token', $tokenData);
    }
    
    protected function generateCodeVerifier(): string
    {
        return rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '=');
    }
    
    protected function generateCodeChallenge(string $verifier): string
    {
        $hash = hash('sha256', $verifier, true);
        return rtrim(strtr(base64_encode($hash), '+/', '-_'), '=');
    }
}

Building enterprise-grade OAuth2 servers with Laravel requires careful attention to security, scalability, and compliance with OAuth2 specifications. These advanced patterns enable creating robust authorization infrastructure that can handle complex enterprise requirements while maintaining security and performance standards essential for large-scale Laravel applications.