OAuth2-lib

pypi_version Supported python versions codecov

This project contains a number of classes to perform authentication (AuthN) and authorization (AuthZ) in a FastAPI application.

They can be found in oauth2_lib/fastapi.py. Most notable are:

  • OIDCAuth: AuthN implementation that authenticates a user against a OIDC backend. You can subclass and implement def userinfo() as needed.
    • To use a different AuthN method, subclass the Authentication base class.
  • OIDCUserModel: model of the data returned by OIDCAuth. You can subclass this to rename and/or add fields.
  • OPAAuthorization: AuthZ implementation that authorizes a user's HTTP request against an Open Policy Agent (OPA) instance.
    • To use a different AuthZ method, subclass the Authorization base class.
  • GraphQLOPAAuthorization: AuthZ implementation that authorizes a user's GraphQL query against an Open Policy Agent (OPA) instance.
    • To use a different AuthZ method, subclass the GraphqlAuthorization base class.
  • OPAResult: model of the data returned by OPAAuthorization and GraphQLOPAAuthorization.

The orchestrator-core documentation has a section on Authentication and Authorization that describes how to use/override these classes.

Upgrading to 3.0.0

3.0.0 replaces httpx with httpx2. The client passed to OIDCAuth.userinfo(), OIDCAuth.check_openid_config() and OPAMixin.get_decision() is now an httpx2.AsyncClient.

The annotation only affects type checking, but any value you pass back into that client must come from httpx2 too — an httpx.BasicAuth, Timeout or Limits raises TypeError at runtime:

# Before
from httpx import AsyncClient, BasicAuth


class MyOIDCAuth(OIDCAuth):
    async def userinfo(self, async_request: AsyncClient, token: str) -> OIDCUserModel:
        response = await async_request.post(url, auth=BasicAuth(id, secret))
        return OIDCUserModel(response.json())


# After
from httpx2 import AsyncClient


class MyOIDCAuth(OIDCAuth):
    async def userinfo(self, async_request: AsyncClient, token: str) -> OIDCUserModel:
        response = await async_request.post(url, auth=(id, secret))
        return OIDCUserModel(response.json())

A plain (id, secret) tuple is accepted by both stacks, so that part can land before you upgrade.

The httpx[http2] extra is gone as well; the library only ever made HTTP/1.1 requests, so h2 is no longer installed transitively. If you relied on oauth2-lib to pull httpx into your environment, declare it yourself.

Installation

To install the package from PyPI:

pip install oauth2-lib

Development

Virtual Environment

Steps to setup a virtual environment.

Install uv and create the development environment:

uv sync --locked --group test --group dev

Run project commands through that environment with uv run, for example:

uv run pytest

Unit tests

Run the unit tests through the uv-managed environment:

uv run pytest

Pre-commit

This project uses pre-commit to automatically run a number of checks before making a git commit. The same checks will be performed in the CI pipeline so this can save you some time.

First ensure you have pre-commit installed. It is recommended to install it outside the virtualenv. On Linux and Mac, pre-commit is available in most package managers. Alternatively you can install it globally with pipx.

Once pre-commit is installed, go into the project root and enable it:

pre-commit install

This should output pre-commit installed at .git/hooks/pre-commit. The next time you run git commit the pre-commit hooks will validate your changes.

Set the package version

When a release version has been assigned, update the package metadata on a clean branch with uv version:

uv version 2.7.1

Specify the full version explicitly so release candidates can be represented, for example uv version 2.7.1rc1.

Supported Python versions

oauth2-lib must support the same python versions as orchestrator-core.

Exceptions to this rule are:

  • A new python version is released: oauth2-lib should support the new version before orchestrator-core does
  • Support for an old python version is dropped: oauth2-lib should drop the python version after orchestrator-core does

Project links

Data verified by PyPI on Aug 13, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (3.0.1)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for automation-beheer from gravatar.com automation-beheer

Credits

Author: SURF

GitHub Statistics

Data verified by PyPI on Aug 13, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python <3.15, >=3.11

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

oauth2_lib-3.0.0.tar.gz (27.5 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

oauth2_lib-3.0.0-py3-none-any.whl (19.2 kB view details)

Uploaded Python 3

File details

Details for the file oauth2_lib-3.0.0.tar.gz.

File metadata

  • Download URL: oauth2_lib-3.0.0.tar.gz
  • Upload date:
  • Size: 27.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for oauth2_lib-3.0.0.tar.gz
Algorithm Hash digest
SHA256 b1dc793e6327b499265d5a5f0637f472bbe3ee10b687f189769844993cf3c62c
MD5 e9c8b63ddb1916ad84ffd8aefb8d349f
BLAKE2b-256 ba7c17b86d3b232f23f2571356644cc7d486eeadc508578c67692b7379bfae10

See more details on using hashes here.

Provenance

The following attestation bundles were made for oauth2_lib-3.0.0.tar.gz:

Publisher: publish-release.yml on workfloworchestrator/oauth2-lib

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file oauth2_lib-3.0.0-py3-none-any.whl.

File metadata

  • Download URL: oauth2_lib-3.0.0-py3-none-any.whl
  • Upload date:
  • Size: 19.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for oauth2_lib-3.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 031c33884367d4702450fde081b9c23625460a7d2f8adbf06e7db49098cde50b
MD5 1cd79176df5c2bac7f1228940e6efa5e
BLAKE2b-256 35eccf32e8c0163629f3bfdd54114f396e765289db12c31f46560a795b546cbd

See more details on using hashes here.

Provenance

The following attestation bundles were made for oauth2_lib-3.0.0-py3-none-any.whl:

Publisher: publish-release.yml on workfloworchestrator/oauth2-lib

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

3.0.1

2 files

This release

3.0.0 This release

2 files

2.7.0

2 files

2.6.1

2 files

2.6.0

2 files

2.5.0

2 files

2.4.2

2 files

2.4.1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.0

2 files

2.1.0

2 files

2.0.2

2 files

2.0.1

2 files

2.0.0

2 files

1.5.0

2 files

1.4.2

2 files

1.4.1

2 files

1.4.0

2 files

1.3.4

2 files

1.3.3

2 files

1.3.2

2 files

1.3.1

2 files

1.3.0

2 files

1.2.10

2 files

1.2.9

2 files

1.2.8

2 files

1.2.7

2 files

1.2.6

2 files

1.2.5

2 files

1.2.4

2 files

1.2.3

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.3

2 files

1.1.2

2 files

1.1.1

2 files

1.1.0

2 files

1.0.14

2 files

1.0.13

2 files

1.0.12

2 files

1.0.11

2 files

1.0.10

2 files

1.0.9

2 files

1.0.8

2 files

1.0.7

2 files

1.0.6

2 files

1.0.5

2 files

1.0.4

2 files

1.0.3

2 files

1.0.2

2 files

1.0.1

2 files

1.0.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page