Skip to main content

Datasette plugin for authenticating access using passwords

Project description


PyPI Changelog License

Datasette plugin for authenticating access using passwords


Install this plugin in the same environment as Datasette.

$ datasette install datasette-auth-passwords


A demo of this plugin is running at

The demo is configured to show the public.db database to everyone, but the private.db database only to logged in users.

You can log in at with username root and password password!.


This plugin works based on a list of username/password accounts that are hard-coded into the plugin configuration.

First, you'll need to create a password hash. There are three ways to do that:

Now add the following to your metadata.json:

    "plugins": {
        "datasette-auth-passwords": {
            "someusername_password_hash": {
                "$env": "PASSWORD_HASH_1"

The password hash can now be specified in an environment variable when you run Datasette. You can do that like so:

PASSWORD_HASH_1='pbkdf2_sha256$...' \
    datasette -m metadata.json

Be sure to use single quotes here otherwise the $ symbols in the password hash may be incorrectly interpreted by your shell.

You will now be able to log in to your instance using the form at /-/login with someusername as the username and the password that you used to create your hash as the password.

You can include as many accounts as you like in the configuration, each with different usernames.

datasette hash-password

The plugin exposes a new CLI command, datasette hash-password. You can run this without arguments to interactively create a new password hash:

% datasette hash-password
Repeat for confirmation: 

Or if you want to use it as part of a script, you can add the --no-confirm option to generate a hash directly from a value passed to standard input:

% echo 'my password' | datasette hash-password --no-confirm

Specifying actors

By default, a logged in user will result in an actor block that just contains their username:

    "id": "someusername"

You can customize the actor that will be used for a username by including an "actors" configuration block, like this:

    "plugins": {
        "datasette-auth-passwords": {
            "someusername_password_hash": {
                "$env": "PASSWORD_HASH_1"
            "actors": {
                "someusername": {
                    "id": "someusername",
                    "name": "Some user"

HTTP Basic authentication option

This plugin defaults to implementing login using an HTML form that sets a signed authentication cookie.

You can alternatively configure it to use HTTP Basic authentication instead.

Do this by adding "http_basic_auth": true to the datasette-auth-passwords block in your plugin configuration.

This option introduces the following behaviour:

  • Account usernames and passwords are configured in the same way as form-based authentication
  • Every page within Datasette - even pages that normally do not use authentication, such as static assets - will display a browser login prompt
  • Users will be unable to log out without closing their browser entirely

There is a demo of this mode at - sign in with username root and password password!

Using with datasette publish

If you are publishing data using a datasette publish command you can use the --plugin-secret option to securely configure your password hashes (see secret configuration values).

You would run the command something like this:

datasette publish cloudrun mydatabase.db \
    --install datasette-auth-passwords \
    --plugin-secret datasette-auth-passwords root_password_hash 'pbkdf2_sha256$...' \
    --service datasette-auth-passwords-demo

This will allow you to log in as username root using the password that you used to create the hash.


To set up this plugin locally, first checkout the code. Then create a new virtual environment:

cd datasette-auth-passwords
python3 -mvenv venv
source venv/bin/activate

Or if you are using pipenv:

pipenv shell

Now install the dependencies and tests:

pip install -e '.[test]'

To run the tests:


Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

datasette-auth-passwords-1.1.tar.gz (6.5 kB view hashes)

Uploaded Source

Built Distribution

datasette_auth_passwords-1.1-py3-none-any.whl (7.7 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page