The expression return $response returns the type Psr\Http\Message\MessageInterface which includes types incompatible with the return type mandated by League\OAuth2\Server\Res...:generateHttpResponse() of Psr\Http\Message\ResponseInterface. Consider adding a type-check to rule them out.