Comment by jeroenhd

If the backend can be reached, yes.

If you put the oauth wall in front of the application before it can even reach PHP (i.e. in your nginx/caddy/apache config), then no, assuming all paths are covered.