outlabs-auth 0.1.0a13

Open-source FastAPI authentication and authorization library with RBAC, ABAC, and Postgres-backed permissions.

OutlabsAuth

Open-source FastAPI authentication and authorization for RBAC, ABAC, API keys, and Postgres-backed permission models.

Alpha release - Public PyPI packaging is supported, but the API surface is still settling before 1.0.

Status

Current Library Version: 0.1.0a13

Release Stage: Alpha

What It Does

OutlabsAuth is a library-first auth system for FastAPI applications that want to keep authentication and authorization inside the app instead of outsourcing it to a separate service.

• SimpleRBAC and EnterpriseRBAC presets
• JWT auth, refresh tokens, API keys, service tokens, and OAuth hooks
• Postgres-backed users, roles, permissions, entities, and audit history
• FastAPI router factories, middleware, and CLI migrations

Install

pip install outlabs-auth

You will also need a PostgreSQL database available to the consuming app.

The consuming app owns its own configuration. In practice that means you provide:

• a PostgreSQL connection URL
• a JWT signing secret
• any app-specific entity, membership, or host-query integrations you want on top of the base library

Quickstart

from contextlib import asynccontextmanager

from fastapi import FastAPI
from outlabs_auth import SimpleRBAC, register_exception_handlers
from outlabs_auth.routers import get_auth_router

auth = SimpleRBAC(
    database_url="postgresql+asyncpg://postgres:postgres@localhost:5432/app",
    secret_key="change-me",
    auto_migrate=True,
)


@asynccontextmanager
async def lifespan(app: FastAPI):
    await auth.initialize()
    yield
    await auth.shutdown()


app = FastAPI(lifespan=lifespan)
register_exception_handlers(app)
app.include_router(get_auth_router(auth, prefix="/auth"))

This example uses auto_migrate=True for convenience. For production, run migrations explicitly with the packaged CLI instead of relying on startup migration.

CLI Bootstrap

After installation, the package exposes an outlabs-auth CLI for schema setup and initial seeding.

export DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/app
# optional: export OUTLABS_AUTH_SCHEMA=auth

outlabs-auth migrate
outlabs-auth seed-system
outlabs-auth bootstrap-admin --email [e-mail] --password change-me

Recommended Production Defaults

For real deployments, use the library with explicit, optimized baseline settings rather than the convenience quickstart defaults.

App configuration baseline

from outlabs_auth import EnterpriseRBAC

auth = EnterpriseRBAC(
    database_url="postgresql+asyncpg://user:password@db-host/app?ssl=require",
    database_schema="outlabs_auth",
    secret_key="replace-me",
    auto_migrate=False,
    enable_caching=True,
    redis_url="redis://cache-host:6379/0",
)

Recommended defaults:

• use an explicit auth schema such as outlabs_auth
• keep auto_migrate=False in normal runtime
• enable Redis caching for enterprise/admin-heavy apps
• mount the library under an app-owned prefix such as /iam

Database connection guidance

For managed Postgres providers that offer both direct and transaction-pooler URLs, prefer the direct runtime URL for auth-heavy apps.

Why:

• OutlabsAuth already uses SQLAlchemy connection pooling
• auth and permission checks often perform multiple small round trips
• transaction-pooler endpoints add measurable latency for those query patterns
• non-public auth schemas depend on reliable per-connection schema resolution

Use:

• postgresql+asyncpg://...

Avoid as the primary runtime URL when you can:

• transaction-pooler URLs such as provider -pooler endpoints

Bootstrap and worker startup

Do not rely on auto_migrate=True inside a multi-worker application runtime.

Recommended pattern:

1. Run the packaged CLI in a single-process release or prestart step.
2. Start the application workers only after that step succeeds.

Example:

export DATABASE_URL='postgresql+asyncpg://user:password@db-host/app?ssl=require'
export OUTLABS_AUTH_SCHEMA='outlabs_auth'

outlabs-auth migrate
outlabs-auth seed-system

exec uvicorn myapp.main:app --host 0.0.0.0 --port 8000 --workers 2

This avoids worker races and keeps schema ownership explicit.

Current operator workflow

Today, the recommended operational commands are:

• outlabs-auth migrate
• outlabs-auth seed-system
• outlabs-auth bootstrap-admin
• outlabs-auth tables
• outlabs-auth current

The intended next step for the library is a more explicit operator experience around first-boot and diagnosis, such as outlabs-auth bootstrap and outlabs-auth doctor. Until that exists, prefer explicit CLI-driven prestart or release-hook flows over implicit runtime bootstrap.

More

The repository includes deeper examples, packaged CLI flows, and design notes:

• GitHub: https://github.com/outlabsio/outlabsAuth
• Examples: examples/
• Maintainer release guide: docs/PRIVATE_RELEASE.md

License

MIT, copyright 2026 OUTLABS LLC.