Drupal Simple OAuth Patterns

Comprehensive patterns for working with the simple_oauth module for OAuth2 authentication in Drupal. Use when working with API authentication, mobile app tokens, or OAuth2 implementation.

Version Information

• simple_oauth: 6.0.9
• Scope provider: dynamic (role-based granularity)
• Current Drupal: 10.x/11.x compatible

Critical OAuth Token Concepts

TokenAuthUser: The Core Authentication Wrapper

When a request is authenticated with an OAuth token, Drupal wraps the user in a TokenAuthUser decorator that enforces BOTH token AND user permissions.

Location: /docroot/modules/contrib/simple_oauth/src/Authentication/TokenAuthUser.php

Permission Check Logic (Line 95)