Self-Hosted SSO from Scratch with Laravel Passport

A hands-on guide to being your own Identity Provider — with Laravel 12 and Passport v13. You will build a Central Portal that acts as an OAuth 2.0 Authorization Server, then wire up child sites ( Site A , Site B , Site C ) so a user logs in once and gets access to all of them. No Google. No Auth0. No Keycloak. No "Sign in with…" anything. You own the users table, you issue the codes and tokens, you hold the signing keys. The only dependency is laravel/passport , which implements the OAuth 2.0 protocol machinery — every identity decision is yours to make, and this guide walks through each one. The scope is deliberately narrow: authentication only. How a user proves who they are at a central server, and how a child site learns that identity. Everything else (admin CRUD screens, audit logging, UI theming) is left out. Everything here is buildable on a fresh Laravel install. No prior context needed. Table of Contents What We Are Building OAuth 2.0 Foundations System Architecture Authentication Workflows Part A — Building the Central Portal Part B — Building a Child Site Registering a Child Site End-to-End Testing Gotchas & Security Notes Reference Tables Appendix A — Extending to Multiple User Types Appendix B — Mental Model in One Page 1. What We Are Building The Problem You operate several web applications. Each has its own users table, its own login form, its own password reset flow. When a staff member joins, someone creates four accounts. When they leave, someone must remember to disable four accounts. Passwords drift out of sync. There is no single place to answer "who has access to what?" The Solution One central server owns identity. Every child site delegates login to it. ┌─────────────────────────────┐ │ Central Portal │ │ ┌───────────────────────┐ │ │ │ admin.portal.test │ │ Management UI │ │ │ │ — create users │ └───────────────────────┘ │ — grant per-site access │ ┌───────────────────────┐ │ │ │ sso.portal.test │ │ OAuth 2.0 endpoints │ │ (authorization ser