tiny-ca-gateway

tiny-ca-gateway provides ready-to-use REST API routes for tiny-ca — a lightweight Python Certificate Authority library. Mount a full-featured CA HTTP API into any of your existing applications in minutes.

Built on top of tiny-ca. This package only provides the HTTP layer. For CA internals, certificate issuance logic, and database models, see the tiny-ca documentation.

Features

• 22 REST endpoints — issue, revoke, renew, rotate, verify, download certificates and more
• 4 framework adapters — drop into an existing app without rewriting anything
• Shared core — identical behaviour across all frameworks; integration tests run against all of them
• Bearer token auth — optional, zero-config when CA_API_TOKEN is empty
• OpenAPI / Swagger UI — built-in for FastAPI & Django Ninja; CDN-based for Flask & aiohttp
• Async-native — FastAPI, aiohttp and Django (ASGI) run fully async; Flask uses an asyncio bridge

Supported frameworks

Quick install

Install only what you need:

# FastAPI
pip install "tiny-ca-gateway[fastapi]"

# Flask
pip install "tiny-ca-gateway[flask]"

# aiohttp
pip install "tiny-ca-gateway[aiohttp]"

# Django + Django Ninja
pip install "tiny-ca-gateway[django]"

# Everything
pip install "tiny-ca-gateway[all]"

60-second example

FastAPI

from fastapi import FastAPI
from contextlib import asynccontextmanager
from tiny_ca_gateway.fastapi.lifespan.manager import FastAPILifespanManager
from tiny_ca_gateway.fastapi.api.v1.ca_routes import router

@asynccontextmanager
async def lifespan(app: FastAPI):
    await FastAPILifespanManager(common_name="My CA").on_startup()
    yield

app = FastAPI(lifespan=lifespan)
app.include_router(router, prefix="/api/v1")

Flask

from flask import Flask
from tiny_ca_gateway.flask.lifespan.manager import FlaskCAManager
from tiny_ca_gateway.flask.api.v1.ca_blueprint import ca_bp

def create_app():
    app = Flask(__name__)
    FlaskCAManager(common_name="My CA").init_sync()
    app.register_blueprint(ca_bp, url_prefix="/api/v1/ca")
    return app

aiohttp

from aiohttp import web
from tiny_ca_gateway.aiohttp.lifespan.manager import AiohttpCAManager
from tiny_ca_gateway.aiohttp.api.v1.ca_routes import routes

async def lifespan(app):
    await AiohttpCAManager(common_name="My CA").on_startup()
    yield

app = web.Application()
app.cleanup_ctx.append(lifespan)
app.add_subapp("/api/v1/ca", web.Application())
app.router.add_routes(routes)

Django Ninja

# urls.py
from ninja import NinjaAPI
from tiny_ca_gateway.django.api.v1.ca_router import ca_router

api = NinjaAPI()
api.add_router("/ca", ca_router)

urlpatterns = [path("api/v1/", api.urls)]

Environment variables

API reference

All adapters expose the same 22 endpoints under the configured prefix:

Running the integration tests

# Start any backend first, then:
python tests/ca_integration_test.py --base-url http://localhost:8000

# Run against all frameworks automatically:
task run-all-tests TOKEN=mysecret

License

MIT — see LICENSE.