AuthLM is a Python library that handles authentication and credential management for AI provider APIs — so your app doesn't have to hand-roll OAuth flows, token refresh, or plaintext key storage for every provider you support. It is auth-only by design: AuthLM doesn't route requests, pick models, or replace an inference library. It does one job, hands you a working credential, and gets out of the way.

Quick start

pip install authlm

import authlm
from datetime import timedelta
from openai import AsyncOpenAI

# Connect once — interactive API key prompt, stored in OS keychain
await authlm.connect("openai", alias="default", method_id="api_key")

# Get a valid credential — auto-refreshes if expired or expiring soon
cred = await authlm.get_valid_credential("openai", alias="default", margin=timedelta(minutes=5))

# Use with any inference library
client = AsyncOpenAI(api_key=cred.secret)

Multiple accounts, one provider:

await authlm.connect("openai", alias="personal", method_id="api_key")
await authlm.connect("openai", alias="work", method_id="api_key")

work_cred = await authlm.get_valid_credential("openai", alias="work", margin=timedelta(minutes=5))

Check if your credential still works:

await authlm.validate(cred, force=True)  # probes the provider's API

Why AuthLM?

Every AI provider speaks its own dialect of auth: some want a simple API key, some support OAuth with browser-based PKCE flows, some use headless device-code flows, and some rotate refresh tokens in ways that are easy to get wrong. Most libraries treat credentials as an afterthought — reading from env vars or plaintext files.

AuthLM abstracts all of that into one consistent API. Adding a new provider to your app is a matter of picking a provider ID, not building a new auth integration from scratch.

Features

• OS keychain by default — macOS Keychain, Windows Credential Manager, Linux Secret Service via keyring. Never plaintext.
• Multiple connection methods — API key, OAuth browser (PKCE), OAuth device code. Warning-gated methods require explicit confirmation.
• Token refresh with rotation — persists new access and refresh tokens atomically, preventing the common "kept the old refresh token" failure mode.
• Multi-account — every credential is keyed by (provider, alias). personal and work OpenAI accounts coexist.
• Fingerprint-based change detection — compute_fingerprint() stores a truncated SHA-256 of the secret; authlm status warns if the secret has changed since last connect.
• Validation probes — validate() issues a lightweight API call to confirm a credential works. Warned methods require force=True.
• Public OAuth client IDs — bundled client IDs for OpenAI Codex, Anthropic Claude Code, and Google AI Studio. Override via env vars.
• 5-command CLI — connect, list, status, disconnect, env with shell/docker/GitHub Actions export formats.
• Zero telemetry — no analytics, no phone-home, no crash reports.

What it is not

• Not an inference library. Use LiteLLM, the OpenAI SDK, the Anthropic SDK, or llm for model calls.
• Not a model router. Use LiteLLM.
• Not a SaaS integration platform. Use Nango or Composio for SaaS OAuth.
• Not a secret broker for running agents. Use Infisical Agent Vault for agent-runtime secret injection.

Installation

pip install authlm                       # base + 4 providers
pip install "authlm[openai]"             # installs openai SDK extra
pip install "authlm[all]"                # all provider SDK extras

From source:

git clone https://github.com/vihaan-g/authlm.git
cd authlm
uv sync --all-extras

API

AuthLM exposes six public async functions and a handful of types. Everything is async for API consistency.

Credential types

Use CredentialUnion for discriminated unions, and parse_credential() to deserialize from JSON.

Supported providers

[!NOTE] OpenAI OAuth methods (chatgpt_oauth_browser, chatgpt_oauth_device) produce Codex-scoped access tokens that authenticate against chatgpt.com/backend-api/codex, not the standard api.openai.com API. A Codex-compatible client is required to use these tokens. For standard OpenAI API access, use the api_key method. Validation probes (validate() / authlm status --validate) are not supported for these methods.

Error hierarchy

All exceptions inherit from AuthLMError. Key types:

CLI

# Connect a provider
authlm connect openai --alias work

# List all stored credentials
authlm list

# Inspect credentials, optionally probe them
authlm status openai --all --validate

# Delete a credential
authlm disconnect openai --alias work

# Export to shell, Docker, or GitHub Actions
eval "$(authlm env openai --alias work)"
authlm env openai --export-format github

[!TIP] Non-TTY environments must pass --method — connect won't open an interactive picker in CI.

Credential stores

Override: AUTHLM_STORE=encrypted_file authlm connect openai or authlm.set_store(store).

Environment variables

Roadmap

Development

uv sync --all-extras                # install all deps
uv run pytest                       # unit tests, under 10 seconds
uv run ruff check .                 # lint
uv run ruff format .                # format
uv run mypy src/authlm              # typecheck (strict)
uv run authlm --help                # CLI smoke test

CI runs the full matrix: 3 OS × 4 Python versions, plus pip-audit, secrets-grep, ruff, and mypy strict.

Security

AuthLM is a credential library — security is the product. See SECURITY.md for the threat model, per-backend security notes, redaction policy, and disclosure process.

Report vulnerabilities privately via GitHub's "Report a vulnerability" button on the Security tab — not via public issues.