Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

elo's avatar
Level 3

Passing social auth response back to api

I need to add social login to a laravel API application project. I have successfully implemented the social login using socialite with the set up below

web.php

Auth::routes(['verify' => true]);

Route::get('/auth/{provider}', 'SocialAuthController@redirectToProvider');

Route::get('/auth/{provider}/callback', 'SocialAuthController@handleProviderCallback');

SocialauthController methods are

public function redirectToProvider($provider)
{
    return Socialite::driver($provider)->redirect();
}

public function handleProviderCallback($provider)
{
    // retrieve social user info
    $socialUser = Socialite::driver($provider)->stateless()->user();

    // check if social user provider record is stored
    $userSocialAccount = SocialAccount::where('provider_id', $socialUser->id)->where('provider_name', $provider)->first();

    if ($userSocialAccount) {

        // retrieve the user from users store
        $user = User::find($userSocialAccount->user_id);

        // assign access token to user
        $token = $user->createToken('******')->accessToken;

        // return access token & user data
        return response()->json([...]);
    } else {

        // store the new user record
        $user = User::create([...]);

        // store user social provider info
        if ($user) {

            SocialAccount::create([...]);
        }

        // assign passport token to user
        $token = $user->createToken('******')->accessToken;
        
        return response()->json([...]);
    }
}

When the react app consuming the api makes a call to https://app-domain-name/auth/google the user is redirected to google and the user is successfully authenticated. But the response is being returned to the browser window where the user was redirected to from the app.

How do I redirect the user back to the app with the response? I need to do this so that the granted access token can be used to access app resources.

0 likes
1 reply
elo's avatar
Level 3

Now here's what I have tried to fix the issue

  1. I get the response from social provider
  2. Store the info and generate an access token for the user
  3. Redirect back to the app that made the call with the access token

Like this

return redirect('http://app.herokuapp.com')->with(['token' => $token, 'user' => $user]);

Now when I hit API app route domain/auth/google, after google login is successful, user gets redirected to http://app.herokuapp.com but I cannot see the token and user data in console.

That's one issue, secondly because the social login route domain/auth/google will be called by 2 different applications; I will have to add an if statement to check which app the authentication is being made from. Meaning more code, I don't think that's the best approach so I am still looking for one

Please or to participate in this conversation.