cauthy

Cauthy for Python backends: verify the access tokens and webhooks Cauthy signs, check what a person may do in an organization, and let the application manage its own organizations.

pip install cauthy                 # or "cauthy[fastapi]", "cauthy[django]", "cauthy[flask]"

import cauthy

who = cauthy.verify_token(request.headers)        # 401 on CauthyTokenError
orgs = cauthy.organizations_of(who)               # their organizations, with permissions
cauthy.can(orgs[0], "invoicing", "write")         # a lookup: no call to Cauthy

event = cauthy.verify_webhook(headers, raw_body, url="https://app.example.com/hooks/cauthy")

system = cauthy.System()                          # the application acting on its own
org = system.organizations.create(name="Acme", external_id="acme")
system.members.add(org.id, email="ana@acme.com", role="admin")

FastAPI:

from fastapi import Depends
from cauthy import Identity, SessionOrganization
from cauthy.fastapi import require_permission, require_session

@app.get("/me")
async def me(who: Identity = Depends(require_session)): ...

@app.post("/orgs/{organization_id}/invoices")
async def create(org: SessionOrganization = Depends(require_permission("invoicing:write"))): ...

Configuration comes from CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET (or CAUTHY_SYSTEM_KEY and CAUTHY_SYSTEM_KEY_ID) and CAUTHY_SYSTEM, or from cauthy.Settings. Python 3.10 or later; every call has an async twin.

The full guide: https://cauthy.docs.vennet.dev/guide/sdk-python

Developing

uv sync
uv run pytest
uv run ruff check src tests && uv run mypy