Authlib

The ultimate Python library in building OAuth and OpenID Connect servers. JWS, JWK, JWA, JWT are included.

Authlib is compatible with Python2.7+ and Python3.6+.

authorization_server.register_grant(AuthorizationCodeGrant)
authorization_server.register_grant(ImplicitGrant)
authorization_server.register_grant(ResourceOwnerPasswordGrant)
authorization_server.register_grant(ClientCredentialsGrant)
authorization_server.register_grant(RefreshTokenGrant)
authorization_server.register_grant(AuthorizationCodeGrant, [OpenIDCode()])
authorization_server.register_grant(OpenIDImplicitGrant)
authorization_server.register_grant(OpenIDHybridGrant)
authorization_server.register_endpoint(RevocationEndpoint)
authorization_server.register_endpoint(IntrospectionEndpoint)

Sponsors

	If you want to quickly add secure token-based authentication to Python projects, feel free to check Auth0's Python SDK and free plan at auth0.com/overview.
	For quickly implementing token-based authencation, feel free to check Authing's Python SDK.
	Get professionally-supported Authlib with the Tidelift Subscription.

Support Me via GitHub Sponsors.

Useful Links

1. Homepage: https://authlib.org/.
2. Documentation: https://docs.authlib.org/.
3. Purchase Commercial License: https://authlib.org/plans.
4. Blog: https://blog.authlib.org/.
5. Twitter: https://twitter.com/authlib.
6. StackOverflow: https://stackoverflow.com/questions/tagged/authlib.
7. Other Repositories: https://github.com/authlib.
8. Subscribe Tidelift: https://tidelift.com/subscription/pkg/pypi-authlib.

Spec Implementations

Lovely features that Authlib has built-in:

🎉 RFC5849: The OAuth 1.0 Protocol

• OAuth1Session for Requests
• OAuth1Client for HTTPX
• OAuth 1.0 Client for Flask
• OAuth 1.0 Client for Django
• OAuth 1.0 Server for Flask
• OAuth 1.0 Server for Django

🎉 RFC6749: The OAuth 2.0 Authorization Framework

• OAuth2Session for Requests
• OAuth2Client for HTTPX
• OAuth 2.0 Client for Flask
• OAuth 2.0 Client for Django
• OAuth 2.0 Server for Flask
• OAuth 2.0 Server for Django

🎉 RFC6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage

• Bearer Token for OAuth2Session
• Bearer Token for Flask provider
• Bearer Token for Django provider

🎉 RFC7009: OAuth 2.0 Token Revocation

• Token Revocation for Flask provider
• Token Revocation for Django provider

🎉 RFC7515: JSON Web Signature (JWS)

• Compact serialize and deserialize
• JSON serialize and deserialize

🎉 RFC7516: JSON Web Encryption (JWE)

• Compact serialize and deserialize
• JSON serialize and deserialize

🎉 RFC7517: JSON Web Key (JWK)

• "oct" algorithm via RFC7518
• "RSA" algorithm via RFC7518
• "EC" algorithm via RFC7518

🎉 RFC7518: JSON Web Algorithms (JWA)

• Algorithms for JWS
• Algorithms for JWE (some of them)
• Algorithms for JWK

🎉 RFC7519: JSON Web Token (JWT)

• Use JWS for JWT
• Use JWE for JWT
• Payload claims validation

🎉 RFC7521: Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants

• Common Client for Assertion Framework
• Common Server for Assertion Framework

⏳ RFC7522: Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants

RFC7522 will not be included in Authlib.

🎉 RFC7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants

• Using JWTs as Client Authorization
• Using JWTs as Authorization Grants

🎉 RFC7591: OAuth 2.0 Dynamic Client Registration Protocol

• Dynamic Client Registration Endpoint for Flask OAuth 2.0 Server
• Dynamic Client Registration Endpoint for Django OAuth 2.0 Server

⏳ RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol

RFC7592 implementation is in plan.

🎉 RFC7636: Proof Key for Code Exchange by OAuth Public Clients

• Requests, HTTPX, Flask, Django, Starlette integrations
• Server side grant implementation

🎉 RFC7662: OAuth 2.0 Token Introspection

• Token Introspection for Flask OAuth 2.0 Server
• Token Introspection for Django OAuth 2.0 Server

⏳ RFC7797: JSON Web Signature (JWS) Unencoded Payload Option

RFC7797 implementation is in plan.

🎉 RFC8414: OAuth 2.0 Authorization Server Metadata

• Authorization Server Metadata Model
• Well Known URI
• Framework integrations

🎉 RFC8628: OAuth 2.0 Device Authorization Grant

• Device Authorization Endpoint
• Device Code Grant

🎉 OpenID Connect Core 1.0

• OpenID Code Flow
• OpenID Implicit Flow
• OpenID Hybrid Flow
• OpenID Claims validation
• Form Post Response Mode
• OpenID Connect for Flask OAuth 2.0 Server
• OpenID Connect for Django OAuth 2.0 Server

🎉 OpenID Connect Discovery 1.0

• OpenID Provider Metadata Model
• Well Known URI
• Framework integrations

And more will be added.

Framework Integrations

Framework integrations with current specification implementations:

• Requests OAuth 1/2 Session
• Requests Assertion Session
• HTTPX sync/async OAuth 1/2 Session
• HTTPX sync/async Assertion Session
• Flask OAuth 1/2 Client
• Django OAuth 1/2 Client
• Starlette OAuth 1/2 Client
• Flask OAuth 1.0 Provider
• Flask OAuth 2.0 Provider
• Flask OpenID Connect 1.0
• Django OAuth 1.0 Provider
• Django OAuth 2.0 Provider
• Django OpenID Connect 1.0

Security Reporting

If you found security bugs, please do not send a public issue or patch. You can send me email at me@lepture.com. Attachment with patch is welcome. My PGP Key fingerprint is:

72F8 E895 A70C EBDF 4F2A DFE0 7E55 E3E0 118B 2B4C

Or, you can use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.

License

Authlib offers two licenses:

1. BSD for open source projects
2. Commercial license for closed source projects

Companies can purchase a commercial license at Authlib Plans.

Support

If you need any help, you can always ask questions on StackOverflow with a tag of "Authlib". DO NOT ASK HELP IN GITHUB ISSUES.

We also provide commercial consulting and supports. You can find more information at https://authlib.org/support.