PHP OAuth API: Authorize and access APIs using OAuth

This class can authorize the access of users to an API using the OAuth protocol.

It abstracts OAuth 1.0, 1.0a and 2.0 in the same class, so you can use the same obtain a token to authorize the access on behalf of the current user any API that supports any version of the OAuth protocol.

It works on Linux, Windows and any other platform without the PECL PHP OAuth extension.

The access tokens are stored by default in session variables, but there are sub-classes specialized in storing the tokens in database tables, files or cookies.

It provides built-in support to several popular OAuth servers, so you do not have to configure the class manually with all OAuth server specific details.

Currently it provides built-in support for OAuth servers of 37Signals, Amazon, AOL, Bitbucket, Bit.ly, Box.net, Buffer, Copy, Dailymotion, Discogs, Disqus, Dropbox with OAuth 1.0 and 2.0, Etsy, Eventful, Facebook, Fitbit with OAuth 1.0a and 2.0, Flickr, Foursquare, github, Google with OAuth 1.0a and OAuth 2.0, imgur, Infusionsoft, Intuit (Quickbooks), Instagram, Jawbone, LinkedIn with OAuth 1.0a and OAuth 2.0, mail.ru, MailChimp, Mavenlink, Meetup, Microsoft, Misfit Wearables, oDesk, Paypal, Paypal client_credentials application only, Rdio, Reddit, RightSignature, RunKeeper, Salesforce, Scoop.it, StockTwits, SurveyMonkey, TeamViewer, Tumblr, Twitter with OAuth 1.0a and 2.0 for client_credentials authorization, Vimeo, VK, Withings, Wordpress, Xero, XING, Yahoo and Yandex.

Every other OAuth server is supported setting end point URLs and other parameters using specific class variables. Additional servers may be supported without changing the main class by configuring a separate JSON configuration file.

The class can also send requests to API using the previously obtained OAuth access token.

It also supports 2 legged API access, so it can send signed API requests that do not require user authorization.

For mobile or other applications that the user cannot be redirected back to the client application site, this class supports pin based authorization either using OAuth 1.0a or OAuth 2.0.

It can as well obtain access tokens for specific users given their user name and password or using client credentials. It supports OAuth 2.0 authorization flows authorization_code, password and client_credentials.

For servers that support offline access like Google and Box.net, the class can also verify if the access token expired and refresh the token value before sending an API call, without requiring the user presence.

For servers that support re-authentication like Facebook, the class may also force the user to enter this application password on the authorization page.