{"id":747,"library":"authlib","title":"Authlib: OAuth & OpenID Connect Library","description":"Authlib is a comprehensive Python library for building OAuth (1.0 & 2.0) and OpenID Connect (OIDC) clients and servers. It includes full support for JSON Web Signatures (JWS), JSON Web Encryption (JWE), JSON Web Keys (JWK), JSON Web Algorithms (JWA), and JSON Web Tokens (JWT). The library is actively maintained with frequent releases, currently at version 1.6.9, and is compatible with Python 3.9+.","status":"active","version":"1.6.9","language":"python","source_language":"en","source_url":"https://github.com/authlib/authlib","tags":["oauth","openid","authentication","authorization","jwt","flask","django","starlette","fastapi","security"],"install":[{"cmd":"pip install Authlib","lang":"bash","label":"Base Installation"},{"cmd":"pip install Authlib requests # For Requests-based OAuth clients","lang":"bash","label":"Requests Integration"},{"cmd":"pip install Authlib httpx # For HTTPX-based async OAuth clients","lang":"bash","label":"HTTPX Integration (Async)"},{"cmd":"pip install Authlib Flask # For Flask integrations","lang":"bash","label":"Flask Integration"}],"dependencies":[{"reason":"Optional: Required for using Requests-based OAuth clients (e.g., OAuth2Session).","package":"requests","optional":true},{"reason":"Optional: Required for using HTTPX-based asynchronous OAuth clients (e.g., AsyncOAuth2Client).","package":"httpx","optional":true},{"reason":"Optional: Required for using Authlib's Flask client or server integrations.","package":"Flask","optional":true},{"reason":"Optional: Required for using Authlib's Django client or server integrations.","package":"Django","optional":true},{"reason":"Optional: Required for using Authlib's Starlette client integrations.","package":"Starlette","optional":true},{"reason":"Optional: Required for using Authlib's FastAPI client integrations.","package":"FastAPI","optional":true}],"imports":[{"wrong":"from authlib.integrations.flask_client import OAuth","symbol":"OAuth","correct":"from authlib.integrations.flask_client import OAuth"}],"quickstart":{"code":"import os\nfrom flask import Flask, redirect, url_for, session, jsonify\nfrom authlib.integrations.flask_client import OAuth\n\napp = Flask(__name__)\napp.secret_key = os.environ.get('FLASK_SECRET_KEY', 'super-secret-key')\napp.config['GOOGLE_CLIENT_ID'] = os.environ.get('GOOGLE_CLIENT_ID', '')\napp.config['GOOGLE_CLIENT_SECRET'] = os.environ.get('GOOGLE_CLIENT_SECRET', '')\napp.config['GOOGLE_AUTHORIZE_URL'] = 'https://accounts.google.com/o/oauth2/auth'\napp.config['GOOGLE_ACCESS_TOKEN_URL'] = 'https://oauth2.googleapis.com/token'\napp.config['GOOGLE_USERINFO_ENDPOINT'] = 'https://openidconnect.googleapis.com/v1/userinfo'\napp.config['GOOGLE_JWKS_URI'] = 'https://www.googleapis.com/oauth2/v3/certs'\n\n# Configure a dummy URL for local testing\n# In a real app, ensure this is HTTPS and a valid redirect URI configured with your OAuth provider\napp.config['GOOGLE_REDIRECT_URI'] = os.environ.get('GOOGLE_REDIRECT_URI', 'http://127.0.0.1:5000/authorize')\n\noauth = OAuth(app)\n\noauth.register(\n    'google',\n    client_id=app.config['GOOGLE_CLIENT_ID'],\n    client_secret=app.config['GOOGLE_CLIENT_SECRET'],\n    authorize_url=app.config['GOOGLE_AUTHORIZE_URL'],\n    access_token_url=app.config['GOOGLE_ACCESS_TOKEN_URL'],\n    userinfo_endpoint=app.config['GOOGLE_USERINFO_ENDPOINT'],\n    jwks_uri=app.config['GOOGLE_JWKS_URI'], # Required for OIDC id_token validation\n    client_kwargs={'scope': 'openid email profile'}\n)\n\n@app.route('/')\ndef index():\n    user = session.get('user')\n    if user:\n        return f'Hello, {user.get(\"name\", \"User\")}! <a href=\"/logout\">Logout</a>'\n    return '<a href=\"/login\">Login with Google</a>'\n\n@app.route('/login')\ndef login():\n    redirect_uri = url_for('authorize', _external=True)\n    return oauth.google.authorize_redirect(redirect_uri)\n\n@app.route('/authorize')\ndef authorize():\n    try:\n        token = oauth.google.authorize_access_token()\n        userinfo = oauth.google.parse_id_token(token)\n        session['user'] = userinfo\n        return redirect('/')\n    except Exception as e:\n        return f'Authorization failed: {e}', 400\n\n@app.route('/logout')\ndef logout():\n    session.pop('user', None)\n    return redirect('/')\n\nif __name__ == '__main__':\n    # For local development, allow insecure transport\n    # NEVER use in production without proper HTTPS setup\n    os.environ['AUTHLIB_INSECURE_TRANSPORT'] = '1'\n    print(\"To run, set environment variables like:\")\n    print(\"export FLASK_SECRET_KEY='your-flask-secret-key'\")\n    print(\"export GOOGLE_CLIENT_ID='YOUR_GOOGLE_CLIENT_ID'\")\n    print(\"export GOOGLE_CLIENT_SECRET='YOUR_GOOGLE_CLIENT_SECRET'\")\n    print(\"Then: flask --app YOUR_APP_FILE.py run\")\n    app.run(debug=True)","lang":"python","description":"This Flask example demonstrates how to set up an OAuth 2.0 client using Authlib for 'Login with Google'. It registers Google as an OAuth provider, redirects users for authorization, and handles the callback to exchange the authorization code for tokens and retrieve user information. It includes configuration for environment variables and addresses the `InsecureTransportError` for local development."},"warnings":[{"fix":"Set `os.environ['AUTHLIB_INSECURE_TRANSPORT'] = '1'` in your development environment, or ensure your application is served over HTTPS.","message":"When developing locally without HTTPS, Authlib will raise an `InsecureTransportError` as OAuth 2.0 strictly requires HTTPS. To bypass this for local testing, set the environment variable `AUTHLIB_INSECURE_TRANSPORT` to `1` or `true`. This should NEVER be used in production.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Upgrade to Python 3.9+ and refactor client/server integrations according to the new `authlib.integrations` structure. For OAuth 2.0 providers, adapt JWT configuration methods.","message":"Authlib v1.0.0 introduced significant breaking changes, including dropping Python 2 support, removing built-in SQLAlchemy integration, and restructuring framework integrations. If using Flask OAuth 2.0 provider, `OAUTH2_JWT_XXX` configurations were removed, requiring developers to define `.get_jwt_config` on OpenID extensions and grant types.","severity":"breaking","affected_versions":">=1.0.0"},{"fix":"For JWE, instantiate `JsonWebToken` with allowed algorithms: `from authlib.jose import JsonWebToken; jwt_instance = JsonWebToken(['A128KW', 'A128GCM', 'DEF'])`.","message":"In Authlib v1.1.0, the default `authlib.jose.jwt` instance was restricted to only work with JSON Web Signature (JWS) algorithms. If you need to use JWT with JSON Web Encryption (JWE) algorithms, you must explicitly pass the `algorithms` parameter to `JsonWebToken`.","severity":"breaking","affected_versions":">=1.1.0"},{"fix":"Explicitly restrict allowed algorithms when decoding by instantiating `JsonWebToken` with a list of trusted algorithms, or use a custom key loader that provides different keys for symmetric and asymmetric signatures.","message":"By default, `authlib.jose.jwt.decode` parses the `alg` header, potentially allowing symmetric MACs (e.g., HS256) and asymmetric signatures (e.g., RS256) to be combined. This can lead to a signature bypass (CVE-2016-10555).","severity":"gotcha","affected_versions":"All versions"},{"fix":"Keep an eye on future Authlib major releases for official migration guides. For now, be aware that direct `jose` imports might change or require installing `joserfc` separately in the future.","message":"The `authlib.jose` module is being split into a separate `joserfc` package. While still part of Authlib v1.x, this indicates a future architectural shift that may lead to breaking changes in `jose` imports or functionality in Authlib v2.x.","severity":"deprecated","affected_versions":">=1.6.9 (future implications)"}],"env_vars":null,"search_vec":"'1.0':15 '1.6.9':61 '2.0':16 '3.9':67 'activ':53 'algorithm':43 'authent':70 'authlib':1,6 'author':71 'build':13 'client':21 'compat':64 'comprehens':9 'connect':4,19 'current':58 'django':74 'encrypt':35 'fastapi':76 'flask':73 'frequent':56 'full':26 'includ':25 'json':29,33,37,41,46 'jwa':44 'jwe':36 'jwk':40 'jws':32 'jwt':49,72 'key':39 'librari':5,11,51 'maintain':54 'oauth':2,14,68 'oidc':20 'openid':3,18,69 'python':10,66 'releas':57 'secur':77 'server':23 'signatur':31 'starlett':75 'support':27 'token':48 'version':60 'web':30,34,38,42,47","created_at":"2026-03-29T04:19:56.214392+00:00","updated_at":"2026-04-15T21:33:10.567234+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\n  File \"/tmp/tmpc5xmg40p/venv/lib/python3.12/site-packages/authlib/integrations/flask_client/__init__.py\", line 1, in <module>\n    from werkzeug.local import LocalProxy\nModuleNotFoundError: No module named 'werkzeug'"},"ecosystem":"pypi","meta_description":null,"install_score":80,"quickstart_score":0,"quickstart_tag":"stale","pypi_latest":"1.7.2","cli_name":"","cli_version":null,"type":"library","homepage":"https://authlib.org","github":"https://github.com/sponsors/lepture","docs":"https://docs.authlib.org/","changelog":null,"pypi":"https://pypi.org/project/authlib/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","http-networking","web-framework"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"import_fail","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-07-10","install_tag":"verified"}}