OAuth2-lib
This project contains a number of classes to perform authentication (AuthN) and authorization (AuthZ) in a FastAPI application.
They can be found in oauth2_lib/fastapi.py. Most notable are:
OIDCAuth: AuthN implementation that authenticates a user against a OIDC backend. You can subclass and implementdef userinfo()as needed.- To use a different AuthN method, subclass the
Authenticationbase class.
- To use a different AuthN method, subclass the
OIDCUserModel: model of the data returned byOIDCAuth. You can subclass this to rename and/or add fields.OPAAuthorization: AuthZ implementation that authorizes a user's HTTP request against an Open Policy Agent (OPA) instance.- To use a different AuthZ method, subclass the
Authorizationbase class.
- To use a different AuthZ method, subclass the
GraphQLOPAAuthorization: AuthZ implementation that authorizes a user's GraphQL query against an Open Policy Agent (OPA) instance.- To use a different AuthZ method, subclass the
GraphqlAuthorizationbase class.
- To use a different AuthZ method, subclass the
OPAResult: model of the data returned byOPAAuthorizationandGraphQLOPAAuthorization.
The orchestrator-core documentation has a section on Authentication and Authorization that describes how to use/override these classes.
Upgrading to 3.0.0
3.0.0 replaces httpx with httpx2. The client passed to
OIDCAuth.userinfo(), OIDCAuth.check_openid_config() and OPAMixin.get_decision() is now an
httpx2.AsyncClient.
The annotation only affects type checking, but any value you pass back into that client must come
from httpx2 too — an httpx.BasicAuth, Timeout or Limits raises TypeError at runtime:
# Before
from httpx import AsyncClient, BasicAuth
class MyOIDCAuth(OIDCAuth):
async def userinfo(self, async_request: AsyncClient, token: str) -> OIDCUserModel:
response = await async_request.post(url, auth=BasicAuth(id, secret))
return OIDCUserModel(response.json())
# After
from httpx2 import AsyncClient
class MyOIDCAuth(OIDCAuth):
async def userinfo(self, async_request: AsyncClient, token: str) -> OIDCUserModel:
response = await async_request.post(url, auth=(id, secret))
return OIDCUserModel(response.json())
A plain (id, secret) tuple is accepted by both stacks, so that part can land before you upgrade.
The httpx[http2] extra is gone as well; the library only ever made HTTP/1.1 requests, so h2 is no
longer installed transitively. If you relied on oauth2-lib to pull httpx into your environment,
declare it yourself.
Installation
To install the package from PyPI:
pip install oauth2-lib
Development
Virtual Environment
Steps to setup a virtual environment.
Install uv and create the development environment:
uv sync --locked --group test --group dev
Run project commands through that environment with uv run, for example:
uv run pytest
Unit tests
Run the unit tests through the uv-managed environment:
uv run pytest
Pre-commit
This project uses pre-commit to automatically run a number of checks before making a git commit. The same checks will be performed in the CI pipeline so this can save you some time.
First ensure you have pre-commit installed. It is recommended to install it outside the virtualenv. On Linux and Mac, pre-commit is available in most package managers. Alternatively you can install it globally with pipx.
Once pre-commit is installed, go into the project root and enable it:
pre-commit install
This should output pre-commit installed at .git/hooks/pre-commit. The next time you run git commit the pre-commit hooks will validate your changes.
Set the package version
When a release version has been assigned, update the package metadata on a clean branch with uv version:
uv version 2.7.1
Specify the full version explicitly so release candidates can be represented, for example uv version 2.7.1rc1.
Supported Python versions
oauth2-lib must support the same python versions as orchestrator-core.
Exceptions to this rule are:
- A new python version is released: oauth2-lib should support the new version before orchestrator-core does
- Support for an old python version is dropped: oauth2-lib should drop the python version after orchestrator-core does
1 maintainer
Metadata
1 maintainer
Release files for oauth2-lib 3.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| oauth2_lib-3.1.0.tar.gz | 27.6 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| oauth2_lib-3.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 46.7 kB
Release files / oauth2_lib-3.1.0.tar.gz
| Download URL | oauth2_lib-3.1.0.tar.gz |
|---|---|
| Size | 27.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b5b8dc6aeb082e79eed9ed30370aa14006cef15fec4f68ca285b0d793fbfc5a8
|
|
BLAKE2b-256 checksum How to use checksums |
06917e9ae6ed94e82326ac6b786f787f5dc29a5a78f6b7461d21248eeaef2675
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 16, 2026.
Transparency logRelease files / oauth2_lib-3.1.0-py3-none-any.whl
| Download URL | oauth2_lib-3.1.0-py3-none-any.whl |
|---|---|
| Size | 19.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f32623f5b65d6799ccc7780b42c15718cfb87b9e88c8925490bd05b631cec70b
|
|
BLAKE2b-256 checksum How to use checksums |
a152ba9cd637d60aff318e3ddc23ee5140161b262c763da5d2699e86b940a2b3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 16, 2026.
Transparency log
