casdoor-python-sdk

Casdoor's SDK for Python will allow you to easily connect your application to the Casdoor authentication system without having to implement it from scratch.

Casdoor-python-sdk is available on PyPI:

$ pip install casdoor

Casdoor SDK is simple to use. We will show you the steps below.

Step1. Init Config

Initialization requires 5 parameters, which are all str type:

Name (in order)	Must	Description
endpoint	Yes	Casdoor Server Url, such as `http://localhost:8000`
client_id	Yes	Application.client_id
client_secret	Yes	Application.client_secret
certificate	Yes	Same as Casdoor certificate
org_name	Yes	Organization name
application_name	Yes	Application name

from casdoor import CasdoorSDK

certificate = b'''-----BEGIN CERTIFICATE-----
MIIE+TCCAuGgAwIBAgIDAeJAMA0GCSqGSIb3DQEBCwUAMDYxHTAbBgNVBAoTFENh
...
-----END CERTIFICATE-----'''

sdk = CasdoorSDK(
    endpoint,
    client_id,
    client_secret,
    certificate,
    org_name,
    application_name,
)

OR use async version

from casdoor import AsyncCasdoorSDK

certificate = b'''-----BEGIN CERTIFICATE-----
MIIE+TCCAuGgAwIBAgIDAeJAMA0GCSqGSIb3DQEBCwUAMDYxHTAbBgNVBAoTFENh
...
-----END CERTIFICATE-----'''

sdk = AsyncCasdoorSDK(
    endpoint,
    client_id,
    client_secret,
    certificate,
    org_name,
    application_name,
)

If your Casdoor server uses a self-signed certificate (or one issued by a private CA), pass verify to either SDK. It works like the verify argument of requests:

sdk = CasdoorSDK(
    endpoint,
    client_id,
    client_secret,
    certificate,
    org_name,
    application_name,
    verify="/path/to/ca.pem",  # trust this CA bundle; True (default) uses the system CAs, False skips verification (insecure)
)

Step2. Authorize with the Casdoor server

At this point, we should use some ways to verify with the Casdoor server.

To start, we want you understand clearly the verification process of Casdoor. The following paragraphs will mention your app that wants to use Casdoor as a means of verification as APP, and Casdoor as Casdoor.

APP will send a request to Casdoor.
Since Casdoor is a UI-based OAuth provider, you cannot use request management service like Postman to send a URL with parameters and get back a JSON file.
The simplest way to try it out is to type the URL in your browser (in which JavaScript can be executed to run the UI).
Type in the URL in your browser in this format: endpoint/login/oauth/authorize?client_id=xxx&response_type=code&redirect_uri=xxx&scope=read&state=xxx
In this URL the endpoint is your Casdoor's location, as mentioned in Step1; then the xxx need to be filled out by yourself.

Hints:

redirect_uri is the URL that your APP is configured to listen to the response from Casdoor. For example, if your redirect_uri is https://forum.casbin.com/callback, then Casdoor will send a request to this URL along with two parameters code and state, which will be used in later steps for authentication.
state protects the login against CSRF. If you build the URL with sdk.get_auth_link(redirect_uri, state=state), generate a random state (e.g. secrets.token_urlsafe()) on your backend, save it in the user's session, and on the callback reject the request unless the returned state equals the saved one. If you omit it, get_auth_link uses your Application's name, which gives no CSRF protection. If you use casdoor-js-sdk, it already generates and checks state in the browser (sessionStorage) before calling your backend's signinPath, so the backend only needs to exchange the code.
Of course you want your APP to be able to send the URL. For example you should have something like a button, and it carries this URL. So when you click the button, you should be redirected to Casdoor for verification. For now you are typing it in the browser simply for testing.

Step3. Get token and parse

After Casdoor verification passed, it will be redirected to your application with code and state as said in Step2, like https://forum.casbin.com/callback?code=xxx&state=yyyy.

Your web application can get the code and call get_oauth_token(code=code), then parse out jwt token.

The general process is as follows:

token = sdk.get_oauth_token(code=code)
access_token = token.get("access_token")
decoded_msg = sdk.parse_jwt_token(access_token) # or sdk.parse_jwt_token(access_token, kwargs)

decoded_msg is the JSON data decoded from the access_token, which contains user info and other useful stuff.

Step4. Interact with the users

casdoor-python-sdk support basic user operations, like:

get_user(user_id: str), get one user by user name.
get_users(), get all users.
modify_user(method: str, user: User)/add_user(user: User)/update_user(user: User)/delete_user(user: User), write user to database.
refresh_token_request(refresh_token: str, scope: str), refresh access token
enforce(self, permission_model_name: str, sub: str, obj: str, act: str, v3: Optional[str], v4: Optional[str], v5: Optional[str]), check permission from model
batch_enforce(self, permission_model_name: str, permission_rules: list[list[str]]), batch check permission from model
get_user_count(is_online: bool = None), get user count.

Resource Owner Password Credentials Grant

If your application doesn't have a frontend that redirects users to Casdoor and you have Password Credentials Grant enabled, then you may get access token like this:

token = sdk.get_oauth_token(username=username, password=password)
access_token = token.get("access_token")
decoded_msg = sdk.parse_jwt_token(access_token) # or sdk.parse_jwt_token(access_token, kwargs)

decoded_msg is the JSON data decoded from the access_token, which contains user info and other useful stuff.

Client Credentials Grant

You can also use Client Credentials Grant when your application does not have a frontend. It is important to note that the AccessToken obtained in this way differs from other in that it corresponds to the application rather than to the user.

token = sdk.get_oauth_token()
access_token = token.get("access_token")
decoded_msg = sdk.parse_jwt_token(access_token) # or sdk.parse_jwt_token(access_token, kwargs)

decoded_msg is the JSON data decoded from the access_token.

Metadata

Release files for casdoor 1.42.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for casdoor 1.42.0
File	Size	Uploaded
casdoor-1.42.0.tar.gz	35.2 kB	Oct 3, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for casdoor 1.42.0
File	Interpreter	ABI	Platform	Reset
casdoor-1.42.0-py2.py3-none-any.whl 54.1 kB Oct 3, 2026	Python 3, Python 2	none	any	Details

Total release size: 89.3 kB

Release files / casdoor-1.42.0.tar.gz

Download URL	casdoor-1.42.0.tar.gz
Size	35.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`ef16b972c0217207d11299149b372c580f2b4e2c98cec2511c74ef5b6dc9f8cf`
BLAKE2b-256 checksum How to use checksums	`b6c3f95200611a14b75cacbb7f6b850d01cbac0a43f81eadff4d988a81744599`
Upload date	Oct 3, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.14.7`

Release files / casdoor-1.42.0-py2.py3-none-any.whl

Download URL	casdoor-1.42.0-py2.py3-none-any.whl
Size	54.1 kB
Tags	Python 2 Python 3
SHA-256 checksum How to use checksums	`5caf27e3508c18fe474ee2c1dd50bd7bcbf2254f50753088328fde6bc3d88aff`
BLAKE2b-256 checksum How to use checksums	`d08968a5cb830a9ff4448a338da76fd5a19b7fba170c9cf316e82ce83aa98fed`
Upload date	Oct 3, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.14.7`