Drupal Simple OAuth Patterns

Comprehensive patterns for working with the simple_oauth module for OAuth2 authentication in Drupal. Use when working with API authentication, mobile app tokens, or OAuth2 implementation.

Version Information

• Verified against simple_oauth 6.1.1 (consumers 8.x-1.24); line numbers below refer to that release
• Scope provider: dynamic (role-based granularity)
• Current Drupal: 10.x/11.x compatible

Critical OAuth Token Concepts

TokenAuthUser: The Core Authentication Wrapper

When a request is authenticated with an OAuth token, Drupal wraps the user in a TokenAuthUser decorator that enforces BOTH token AND user permissions.

Location: <webroot>/modules/contrib/simple_oauth/src/Authentication/TokenAuthUser.php (<webroot> is web/ or docroot/ depending on the project)

Permission Check Logic (Line 95)