title: Using OAuth2 and ZF3-MVC to protect REST API
body: <p>I'm trying to get <a href="https://github.com/zfcampus/zf-oauth2" rel="nofollow noreferrer">https://github.com/zfcampus/zf-oauth2</a> working with my <strong>ZF3-MVC Application</strong> (ok, one solution could be to wait Apigility update).</p>
  
  <p>I have successfully implemented the oauth2-server-php (<a href="https://github.com/bshaffer/oauth2-server-php" rel="nofollow noreferrer">https://github.com/bshaffer/oauth2-server-php</a>), its zf-oauth2 module support (<a href="https://github.com/zfcampus/zf-oauth2" rel="nofollow noreferrer">https://github.com/zfcampus/zf-oauth2</a>) and adapted zf-oauth2 client for ZF3 (<a href="https://github.com/API-Skeletons/zf-oauth2-client" rel="nofollow noreferrer">https://github.com/API-Skeletons/zf-oauth2-client</a>).</p>
  
  <p>However, I'm totaly stuck now trying to protect my API y following zf-oauth2 module's recommandation:</p>
  
  <blockquote>
    <p>You can protect your API using the following code (for instance, at the top of a controller):</p>
  </blockquote>
  
  <pre class="lang-cs prettyprint-override"><code>if (!$this-&gt;server-&gt;verifyResourceRequest(OAuth2Request::createFromGlobals()))
  {
      // Not authorized return 401 error
      $this-&gt;getResponse()-&gt;setStatusCode(401);
      return;
  }
  </code></pre>
  
  <blockquote>
    <p>where $this->server is an instance of OAuth2\Server (see the AuthController.php).</p>
  </blockquote>
  
  <p>I've read this post (<a href="https://stackoverflow.com/questions/23996243/using-zf2-oauth2">Using ZF2 Oauth2</a>) but it's not compliant with ZF3. I guess there's a more efficient way rather than copying/pasting zf-oauth2 module's controller and factory to instantiate the server from scratch.</p>
  
  <p>Would anyone have a clue on how to implement the instance of OAuth2\Server in my API controller?</p>