AuthlibPython 3.10+BSD-3-Clause
OAuth and OpenID Connect for Python.
Build OAuth clients, authorization servers, and protected APIs with protocol implementations that connect cleanly to the Python frameworks you already use.
$
pip install Authlibfrom authlib.integrations.flask_client import OAuth
oauth = OAuth(app)
provider = oauth.register(
"provider", server_metadata_url=metadata_url
)
return provider.authorize_redirect(redirect_uri)from authlib.integrations.flask_oauth2 import ResourceProtector
require_oauth = ResourceProtector()
require_oauth.register_token_validator(token_validator)
@app.get("/api/profile")
@require_oauth("profile")Used in the open
Used across the protocol stack.
From client login to authorization servers and JWT infrastructure, public Python projects use Authlib and joserfc in production code.
- 01Authlib / OAuth clientGradioLogin for shared Python apps
- 02Authlib / OAuth clientOpen WebUIOAuth and OpenID Connect login
- 03Authlib / Authorization serverCanailleOAuth 2.0 and OpenID Connect provider
- 04Authlib / Authorization serveruDataOAuth provider and protected APIs
- 05joserfc / JOSE / JWTFastMCPIssues and verifies OAuth proxy tokens
- 06joserfc / JOSE / JWTFrigateSigns and validates authentication tokens
Find your starting point
What are you building?
Authentication work starts with a role, not a protocol acronym. Choose the task that matches your application and go directly to the right guide.
01AuthlibAdd login with an OAuth or OpenID Connect providerConnect Flask, Django, Starlette, or FastAPI to GitHub, Google, or your own identity provider.02AuthlibRun an OAuth 2.0 or OpenID Connect providerIssue access tokens, register grants and endpoints, and operate an authorization server.03AuthlibProtect an API with access tokensValidate bearer tokens and scopes independently from the service that issued them.04joserfcSign, encrypt, and validate JOSE or JWT dataUse the focused implementation of JWS, JWE, JWK, JWA, and JWT for new JOSE work.05OTP AuthGenerate and verify one-time passwordsAdd standards-based HOTP or TOTP codes to a Python application.
Project family
Projects with clear boundaries.
Install only the protocol surface your application needs. Each package has a focused API and its own documentation.
Starting new JOSE work?Use joserfc. The authlib.jose module is deprecated in Authlib 1.7 and is being replaced by the standalone package.
Why Authlib
One model across both sides of OAuth.
Authlib connects low-level protocol implementations to the Python frameworks where applications actually run. Start with an integration, then extend grants, endpoints, or validators when needed.
Consume a provider
HTTP clients, service accounts, and web application login flows.
Issue tokens
Grants, endpoints, metadata, and OpenID Connect provider primitives.
Protect resources
Bearer token validation, scopes, introspection, and API protection.
- Requests
- HTTPX
- Starlette
- FastAPI
- Flask
- Django
- OAuth 1.0
- OAuth 2.0
- OpenID Connect
- JWS
- JWE
- JWK
- JWA
- JWT
Latest updates
Releases, migrations, and protocol work.
Follow major releases, implementation guides, funded work, and changes across the Authlib project family.
Open source and sustainable
Use Authlib freely. Fund the work when it matters.
The projects are BSD-licensed. Sponsorship and commercial support fund protocol review, releases, compatibility, and documentation.