Consuming OAuth 2.0 APIs

Call a resource server using a short-lived access token in the Authorization header. The examples separate the essential operation from the conditions a production implementation must enforce.

What It Does

Call a resource server using a short-lived access token in the Authorization header.

Prerequisites

Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.

Example 1: Core Behavior

The first example isolates the core operation so its result is easy to understand.

<?php
$token=getenv('OAUTH_ACCESS_TOKEN');
if (!$token) throw new RuntimeException('Missing short-lived access token');
$headers=['Authorization: Bearer '.$token,'Accept: application/json'];
echo count($headers).' request headers configured';

Example 2: Alternative or Failure Case

The second example demonstrates an alternative outcome, rule or failure condition.

<?php
$expiresAt=time()+180;
$refreshBefore=60;
echo time()>=$expiresAt-$refreshBefore?'Refresh now':'Use current token';

Practical Example: Applying the Rule

This practical workflow performs the relevant operation, with strict error checks. Configure the required transport or database driver before running it.

<?php
$accessToken = getenv('OAUTH_ACCESS_TOKEN');
if (!$accessToken) throw new RuntimeException('Configure a short-lived access token');
$ch = curl_init('https://api.example.test/v1/profile');
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $accessToken, 'Accept: application/json'], CURLOPT_CONNECTTIMEOUT => 3, CURLOPT_TIMEOUT => 8, CURLOPT_FOLLOWLOCATION => false]);
$body = curl_exec($ch);
if ($body === false) throw new RuntimeException('Network request failed');
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
if ($status === 401) throw new RuntimeException('Expired or invalid access token');
if ($status !== 200) throw new RuntimeException('Unexpected resource response');
$profile = json_decode($body, true, 512, JSON_THROW_ON_ERROR);
echo 'Validated response fields: ' . count($profile);

Important Behavior and Edge Cases

Never confuse access tokens with ID tokens or place bearer tokens in query parameters.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Call a resource server using a short-lived access token in the Authorization header.
• Never confuse access tokens with ID tokens or place bearer tokens in query parameters.
• Refresh-token handling belongs to a protected credential store.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.