{"id":1482,"library":"flask-jwt-extended","title":"Flask-JWT-Extended","description":"Flask-JWT-Extended is a Python library that provides extended JWT (JSON Web Token) integration for Flask applications. It simplifies the process of adding JWT-based authentication to your API, handling token creation, authorization, and common features like fresh tokens, blocklists, and token refreshing. The current version is 4.7.1, and it maintains a steady release cadence with active development and regular updates to support new Python and Flask versions.","status":"active","version":"4.7.1","language":"python","source_language":"en","source_url":"https://github.com/vimalloc/flask-jwt-extended","tags":["Flask","JWT","Authentication","Security","Web Development","API"],"install":[{"cmd":"pip install Flask-JWT-Extended","lang":"bash","label":"Install latest version"}],"dependencies":[{"reason":"Core web framework integration.","package":"Flask","optional":false},{"reason":"Handles the underlying JWT encoding and decoding.","package":"PyJWT","optional":false},{"reason":"Provides cryptographic primitives for PyJWT's algorithms.","package":"cryptography","optional":false}],"imports":[{"symbol":"JWTManager","correct":"from flask_jwt_extended import JWTManager"},{"symbol":"jwt_required","correct":"from flask_jwt_extended import jwt_required"},{"symbol":"create_access_token","correct":"from flask_jwt_extended import create_access_token"},{"symbol":"get_jwt_identity","correct":"from flask_jwt_extended import get_jwt_identity"}],"quickstart":{"code":"import os\nfrom flask import Flask, jsonify, request\nfrom flask_jwt_extended import create_access_token, jwt_required, JWTManager, get_jwt_identity\n\napp = Flask(__name__)\n# Set a secret key for JWT signing. For production, use a strong, unique key.\napp.config[\"JWT_SECRET_KEY\"] = os.environ.get(\"FLASK_JWT_SECRET_KEY\", \"super-secret-dev-key\")\n\n# Initialize the Flask-JWT-Extended extension\njwt = JWTManager(app)\n\n# A simple login route to get an access token\n@app.route(\"/login\", methods=[\"POST\"])\ndef login():\n    username = request.json.get(\"username\", None)\n    password = request.json.get(\"password\", None)\n\n    # In a real application, you'd verify these credentials against a database\n    if username != \"testuser\" or password != \"testpass\":\n        return jsonify({\"msg\": \"Bad username or password\"}), 401\n\n    access_token = create_access_token(identity=username)\n    return jsonify(access_token=access_token)\n\n# A protected route that requires a valid JWT access token\n@app.route(\"/protected\", methods=[\"GET\"])\n@jwt_required()\ndef protected():\n    # Access the identity of the current user with get_jwt_identity\n    current_user = get_jwt_identity()\n    return jsonify(logged_in_as=current_user), 200\n\nif __name__ == \"__main__\":\n    # To run:\n    # 1. Set FLASK_JWT_SECRET_KEY environment variable (or it will use 'super-secret-dev-key')\n    #    e.g., export FLASK_JWT_SECRET_KEY=\"your-strong-secret\"\n    # 2. Run this script: python your_app.py\n    # 3. Test with curl:\n    #    curl -X POST -H \"Content-Type: application/json\" -d '{\"username\":\"testuser\", \"password\":\"testpass\"}' http://127.0.0.1:5000/login\n    #    (Copy the access_token from the response)\n    #    curl -H \"Authorization: Bearer <your_access_token>\" http://127.0.0.1:5000/protected\n    app.run(debug=True)","lang":"python","description":"This quickstart demonstrates how to initialize Flask-JWT-Extended, create a login endpoint to issue an access token, and protect another endpoint using the `@jwt_required()` decorator. It shows how to retrieve the identity of the authenticated user within a protected route. Remember to set the `FLASK_JWT_SECRET_KEY` environment variable for production environments."},"warnings":[{"fix":"Upgrade your Python version to 3.9 or newer. If not possible, pin `Flask-JWT-Extended<4.7.0`.","message":"Python 3.7 and 3.8 support was dropped in Flask-JWT-Extended 4.7.0. If you are on these Python versions, you must upgrade your Python environment or use a version of Flask-JWT-Extended older than 4.7.0.","severity":"breaking","affected_versions":">=4.7.0"},{"fix":"Upgrade `Flask-JWT-Extended` to version 4.5.3 or newer if using Flask 3.x. Pin `Flask-JWT-Extended<4.5.3` if using Flask <3.0.","message":"Flask 3.0 compatibility was introduced in Flask-JWT-Extended 4.5.3. Applications using Flask 3.x must ensure they are using `flask-jwt-extended>=4.5.3` to avoid compatibility issues.","severity":"breaking","affected_versions":"<4.5.3"},{"fix":"Consult the official migration guide for detailed steps. Be prepared to update token return formats, decorator usage, and configuration settings (e.g., `JWT_SECRET_KEY`).","message":"Migrating from Flask-JWT-Extended v3.x to v4.x involved significant breaking changes, including how tokens are returned (no longer a dict by default), changes to decorators, and more explicit configuration requirements.","severity":"breaking","affected_versions":"3.x to 4.x"},{"fix":"Always set `app.config[\"JWT_SECRET_KEY\"]` explicitly and ensure it is a strong, unique secret key separate from Flask's `SECRET_KEY`.","message":"Flask-JWT-Extended uses `app.config[\"JWT_SECRET_KEY\"]` for signing JWTs, which is distinct from Flask's `app.secret_key` or `app.config[\"SECRET_KEY\"]`. Using Flask's secret key for JWT signing is a common mistake and can lead to unexpected behavior or security vulnerabilities.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Ensure the value passed as `identity` is a unique string representing the user (e.g., user ID, username). If using an object, ensure it can be reliably serialized and deserialized to retrieve the identity later.","message":"The `identity` argument passed to `create_access_token()` (and `create_refresh_token()`) should ideally be a string or a value that can be easily serialized to JSON and uniquely identifies the user. While it may accept other types, the documentation strongly encourages string identities for clarity and consistent behavior.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Review system logs for installation errors. Consider allocating more resources to the build environment or troubleshooting dependency conflicts. Pinning to an older, stable version of `Flask-JWT-Extended` known to work on Python 3.9 might also help.","message":"The library failed to install or run basic tests within the allocated time limit on Python 3.9, indicating a potential issue with dependency resolution, resource utilization, or an unexpected hang during the setup process specific to this environment.","severity":"breaking","affected_versions":"All versions (when running on Python 3.9)"},{"fix":"Avoid using Flask-JWT-Extended with Python 3.13 until official compatibility is announced and verified. Consider using Python versions up to 3.12.","message":"Flask-JWT-Extended appears to be incompatible with Python 3.13, resulting in a timeout during installation or execution. This indicates a potential lack of official support or a critical compatibility issue with this Python version.","severity":"breaking","affected_versions":"All versions (on Python 3.13)"}],"env_vars":null,"search_vec":"'4.7.1':55 'activ':64 'ad':29 'api':36,82 'applic':23 'authent':33,78 'author':40 'base':32 'blocklist':47 'cadenc':62 'common':42 'creation':39 'current':52 'develop':65,81 'extend':4,8,15 'featur':43 'flask':2,6,22,74,76 'flask-jwt-extend':1,5 'fresh':45 'handl':37 'integr':20 'json':17 'jwt':3,7,16,31,77 'jwt-base':30 'librari':12 'like':44 'maintain':58 'new':71 'process':27 'provid':14 'python':11,72 'refresh':50 'regular':67 'releas':61 'secur':79 'simplifi':25 'steadi':60 'support':70 'token':19,38,46,49 'updat':68 'version':53,75 'web':18,80","created_at":"2026-04-09T03:49:50.221898+00:00","updated_at":"2026-04-16T15:07:05.096628+00:00","problems":[{"fix":"pip install flask-jwt-extended","cause":"The 'flask-jwt-extended' package is not installed in the Python environment or the environment where the Flask application is running.","error":"ModuleNotFoundError: No module named 'flask_jwt_extended'"},{"fix":"Replace `@jwt.token_in_blacklist_loader` with `@jwt.token_in_blocklist_loader`. Also, rename related configuration options like `JWT_BLACKLIST_ENABLED` to their `_BLOCKLIST_` equivalents.","cause":"This error occurs in Flask-JWT-Extended v4.0.0 and above because the 'blacklist' terminology was changed to 'blocklist'. The 'token_in_blacklist_loader' decorator no longer exists.","error":"AttributeError: 'JWTManager' object has no attribute 'token_in_blacklist_loader'"},{"fix":"Uninstall any conflicting 'jwt' or 'PyJWT' packages and then reinstall 'PyJWT' and 'flask-jwt-extended': `pip uninstall jwt PyJWT && pip install PyJWT flask-jwt-extended`.","cause":"This typically occurs due to a conflict with an older or incorrect 'jwt' package, or an incompatible version of 'PyJWT' (Flask-JWT-Extended requires PyJWT >= 2.0.0).","error":"ImportError: cannot import name 'DecodeError' from 'jwt'"},{"fix":"Ensure `jwt.init_app(app)` is called after creating your Flask app and JWTManager instance, typically in your application factory or main app file, or pass the app directly to the constructor: `jwt = JWTManager(app)`.","cause":"The JWTManager instance was created but not initialized with the Flask application instance using `jwt.init_app(app)` before JWT-related operations (like decorators) are attempted.","error":"Error: Initialize a JWTManager with this flask application before using this method"}],"ecosystem":"pypi","meta_description":null,"install_score":100,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"4.7.4","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/vimalloc/flask-jwt-extended","docs":null,"changelog":null,"pypi":"https://pypi.org/project/flask-jwt-extended/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["web-framework","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-28","last_verified":"2026-08-27","next_check":"2026-07-28","install_tag":"verified"}}