csrd-auth
Pluggable JWT authentication for FastAPI — authenticators, key providers, and dependency factories.
Tier 2 (bridge) — depends on csrd-models and csrd-context only.
Installation
pip install "csrd-auth @ git+https://github.com/csrd-api/fastapi-common.git#subdirectory=packages/auth"
Usage
from csrd.auth import (
JWTAuthenticator,
StaticKeyProvider,
create_bearer_dependency,
create_jwt_bearer,
)
Quick start — JWT bearer dependency
# Standalone (provide your own token_finder)
from csrd.auth import create_jwt_bearer
auth_dep = create_jwt_bearer(
key="your-secret",
token_finder=lambda: extract_token_from_request(),
)
When used with csrd.versioning, wire in find_token explicitly:
from csrd.auth import create_jwt_bearer
from csrd.versioning import find_token
auth_dep = create_jwt_bearer(key="your-secret", token_finder=find_token)
Authenticators
| Class | Strategy |
|---|---|
JWTAuthenticator |
Decode & verify JWT locally via PyJWT |
StaticAuthenticator |
Accept a fixed token (dev/testing) |
RemoteAuthenticator |
Validate via upstream HTTP endpoint |
CallbackAuthenticator |
Delegate to any sync/async callable |
ChainedAuthenticator |
Try multiple authenticators in order |
Key Providers
| Class | Strategy |
|---|---|
StaticKeyProvider |
Fixed string, bytes, or SecretStr |
EnvKeyProvider |
Read from app.state or settings loader |
JWKSKeyProvider |
Fetch from JWKS endpoint (cached with TTL) |
MultiKeyProvider |
Route by kid header or try all |
CallbackKeyProvider |
Delegate to any callable |
Protocols
Authenticator—(Request, str) -> UserClaimsKeyProvider—(token_headers, app) -> key
Both are @runtime_checkable protocols.
Dependency Tier
Tier 1 csrd.models csrd.lifespan csrd.context
Tier 2 csrd.auth csrd.logging csrd.delegate csrd.repository csrd.service
Tier 3 csrd.versioning
csrd.auth depends only on csrd.models (for UserClaims) and csrd.context (for user_info_context). It has no dependency on csrd.versioning.
1 maintainer
Metadata
1 maintainer
Release files for csrd-auth 0.6.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| csrd_auth-0.6.0.tar.gz | 21.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| csrd_auth-0.6.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 36.2 kB
Release files / csrd_auth-0.6.0.tar.gz
| Download URL | csrd_auth-0.6.0.tar.gz |
|---|---|
| Size | 21.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d8ab763931bf1a64a4ce24f612a9a21074e2a224aee8b509856d873b5bfee869
|
|
BLAKE2b-256 checksum How to use checksums |
c168a8b0c9693149a86955a118f18363d25cbb3a352fdde7ba17bfa71c2db230
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 16, 2026.
Transparency logRelease files / csrd_auth-0.6.0-py3-none-any.whl
| Download URL | csrd_auth-0.6.0-py3-none-any.whl |
|---|---|
| Size | 15.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c9ba460d5110073519416d77eccd5364c75cb247544dedb382bae8306959bccd
|
|
BLAKE2b-256 checksum How to use checksums |
869a2460a69d53a18f032a42f705f4d67a6c11a17cd700084b8d3da2fa2ae1ef
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 16, 2026.
Transparency log
