litestar-auth 7 separates opaque human sessions from certificate-bound workload identity on a shared AuthWeave core

One Python authentication stack. Separate trust paths for people and machines.

Tests Codecov coverage Latest stable release on PyPI Supported Python versions MIT license

litestar-auth 7 is the human-authentication layer in a coordinated three-package stack for Python 3.12–3.14. It keeps browser sessions, workload credentials, and framework-neutral coordination in explicit packages instead of mixing them behind one credential parser.

Choose the layer you need

Package Use it for Install
litestar-auth Registration, login, OAuth + PKCE, TOTP, roles, organizations, and opaque database or Redis sessions in Litestar uv add litestar-auth
authweave-core Typed principals, evidence, decisions, route policies, and fail-closed provider coordination uv add authweave-core
authweave-workload X.509 workload lifecycle, direct mTLS, and externally issued certificate-bound JWTs uv add 'authweave-workload[mtls,jwt]'

All three distributions use coordinated 7.x versions. The dependency direction stays one-way:

authweave-core
├── litestar-auth
└── authweave-workload
    └── authweave-workload[litestar] → litestar-auth Extension SDK v2

Start with a secure human session

uv add litestar-auth aiosqlite

from uuid import UUID

from litestar import Litestar
from litestar_auth import DatabaseTokenAuthConfig, LitestarAuth, LitestarAuthConfig

config = LitestarAuthConfig(
    database_token_auth=DatabaseTokenAuthConfig(
        token_hash_secret=session_digest_secret,
    ),
    csrf_secret=csrf_secret,
    session_maker=session_maker,
    user_model=User,
    user_manager_class=UserManager,
    user_db_factory=user_db_factory,
    user_manager_security=user_manager_security,
)

app = Litestar(plugins=[LitestarAuth(config)])

The quickstart covers schema requirements and links the runnable registration/login flow. Use RedisTokenStrategy with litestar-auth[redis] when sessions belong in Redis. Both implementations issue opaque access and refresh tokens, rotate refresh tokens, revoke replayed chains, and expose safe session metadata.

Keep machine identity on its own path

uv add 'authweave-workload[mtls,jwt,sqlalchemy]'
# Add [litestar] only for the Extension SDK v2 integration.

WorkloadLifecycleService manages service applications, principals, public certificate metadata, overlapping rotation, revocation, and same-transaction security events. Private keys are rejected at the package boundary and are never stored.

At request time:

  • DirectMTLSProvider consumes trusted TLS peer evidence.
  • MTLSBoundJWTProvider verifies an asymmetric access token from a configured external issuer.
  • The token's RFC 8705 thumbprint must match the same peer certificate.
  • Ambiguous credential ownership and provider failures stop authentication; they never fall through to another provider.

The repository includes an Envoy-based reference stack with negative-path verification:

sh docker/reference/verify.sh

Security boundary

Authentication establishes a verified principal and constraints. Your application still owns tenant mapping, row-level security, resource ownership, and business authorization.

Version 7 intentionally does not provide bearer login, user-owned API keys, proprietary HMAC request signing, an OAuth Authorization Server, generic IAM, DPoP, SPIFFE, opaque-token introspection, or production rollout automation.

Documentation

License

MIT

Project links

Data verified by PyPI on Jul 31, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (8.0.2)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for shepilov.v from gravatar.com shepilov.v

Credits

Author/Maintainer: Vladislav Shepilov

GitHub Statistics

Data verified by PyPI on Jul 31, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python <3.15.0, >=3.12.0

Provides Extra

all jwt oauth redis totp

Tags

auth authentication authorization database httpx-oauth jwt library litestar oauth redis

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

litestar_auth-7.0.0.tar.gz (1.2 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

litestar_auth-7.0.0-py3-none-any.whl (449.7 kB view details)

Uploaded Python 3

File details

Details for the file litestar_auth-7.0.0.tar.gz.

File metadata

  • Download URL: litestar_auth-7.0.0.tar.gz
  • Upload date:
  • Size: 1.2 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for litestar_auth-7.0.0.tar.gz
Algorithm Hash digest
SHA256 f5cc25bbbf1c674546be163f5de93f08689d6bf3763b955e5317d9e9a0c8d41f
MD5 10d50da5951f8be99c0fce6e7777fa50
BLAKE2b-256 d0a38114e1fa5b3f1859d10a5c983c6f1e91cf5edfa8435eaa40e3955cd1dbfc

See more details on using hashes here.

Provenance

The following attestation bundles were made for litestar_auth-7.0.0.tar.gz:

Publisher: 3_release.yml on ZYLVEXT/litestar-auth

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file litestar_auth-7.0.0-py3-none-any.whl.

File metadata

  • Download URL: litestar_auth-7.0.0-py3-none-any.whl
  • Upload date:
  • Size: 449.7 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for litestar_auth-7.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 313072f499416fda806c1b6d74489a3c8fb440a08b6ad2d2faf72daea99b3ed7
MD5 5e9b2a12878e37a90a533b69475f439c
BLAKE2b-256 2189a535ff7662fd131031cf91b3bf3ccb7c9c07f66a5cbb98b82903032b916c

See more details on using hashes here.

Provenance

The following attestation bundles were made for litestar_auth-7.0.0-py3-none-any.whl:

Publisher: 3_release.yml on ZYLVEXT/litestar-auth

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

8.0.2

2 files

8.0.1

2 files

8.0.0

2 files

7.3.4

2 files

7.3.3

2 files

7.3.2

2 files

7.3.1

2 files

7.3.0

2 files

7.2.0

2 files

7.1.2

2 files

This release

7.0.0 This release

2 files

6.0.0

2 files

5.3.0

2 files

5.2.0

2 files

5.1.0

2 files

5.0.3

2 files

5.0.2

2 files

5.0.1

2 files

5.0.0

2 files

4.2.0

2 files

4.1.0

2 files

4.0.1

2 files

4.0.0

2 files

3.3.0

2 files

3.2.0

2 files

3.1.0

2 files

3.0.0

2 files

2.4.0

2 files

2.3.0

2 files

2.2.0

2 files

2.1.0

2 files

2.0.0

2 files

1.11.0

2 files

1.10.0

2 files

1.9.0

2 files

1.8.0

2 files

1.7.0

2 files

1.6.1

2 files

1.6.0

2 files

1.5.0

2 files

1.4.0

2 files

1.3.0

2 files

1.2.0

2 files

1.1.1

2 files

1.1.0

2 files

1.0.5

2 files

1.0.4

2 files

1.0.3

2 files

1.0.2

2 files

1.0.1

2 files

1.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page