OAuth 2.0
Debbie provides a fully compliant OAuth 2.0 authorization server built on Laravel Passport, supporting all major grant types for every integration scenario.
Enterprise-Grade OAuth
Debbie's OAuth 2.0 implementation handles the complexity of authorization so your developers don't have to. It supports the most common grant types, refresh tokens, scoped permissions, and PKCE — all configurable through the admin interface.
Supported Grant Types
Authorization Code
The most secure grant type for server-side web applications. Exchanges a temporary code for an access token.
PKCE Flow
Enhanced security for mobile and single-page applications. Prevents authorization code interception attacks.
Client Credentials
Server-to-server authentication where no user context is needed. Ideal for backend services.
Refresh Tokens
Long-lived tokens that allow applications to obtain new access tokens without re-authentication.
OAuth Scopes
Administrators define granular OAuth scopes (e.g., profile.read,
orders.write). Applications request specific scopes during the OAuth flow,
and resource owners grant or deny consent for each scope. Debbie enforces scope
restrictions on every token.
💡 For Platform Administrators
Configure OAuth settings per application: token lifetime, allowed grant types, PKCE requirement, and confidential/public client type. All from the admin dashboard.