zeit.msal

Helper to authenticate against Microsoft Azure AD and store the resulting tokens for commandline applications.

Usage

1. Run interactively to store a refresh token in the cache
2. Use in e.g. automated tests to retrieve an ID token from the cache (which automatically refreshes it if necessary).

$ msal-token --client-id=myclient --client-secret=mysecret \
    --cache-url=file:///tmp/msal.json login
Please visit https://login.microsoftonline.com/...
# Perform login via browser

def test_protected_web_ui():
    auth = zeit.msal.Authenticator('myclient', 'mysecret', 'file:///tmp/msal.json')
    http = requests.Session()
    http.headers['Authorization'] = 'Bearer %s' % auth.get_id_token()
    r = http.get('https://example.zeit.de/')
    assert r.status_code == 200

Alternatively, retrieve the refresh token after interactive login, and use that in tests:

auth.login_with_refresh_token('myrefreshtoken')

Changelog

1.4.1 (2026-10-29)

Maintenance

• convert the README to Markdown (b1df810)
• deps: lock file maintenance (uv) (e5c763e)
• deps: lock file maintenance (uv) (7e6e75e)
• deps: update pre-commit hook astral-sh/ruff-pre-commit to v0.17.1 (2fcadec)
• deps: update pre-commit hook astral-sh/ruff-pre-commit to v0.17.1 (55b4e3a)
• deps: update pre-commit hook pre-commit/pre-commit-hooks to v6.0.0 (5e3351a)
• deps: update pre-commit hook pre-commit/pre-commit-hooks to v6.0.0 (6f9671d)
• release with Release Please via the shared pypi-release workflow (61d6ff3)
• release with Release Please via the shared pypi-release workflow (845b0cd)

1.4.0 (2026-08-26)

• Replace deprecated decode_id_token (msal)

1.3.1 (2025-02-18)

• Update to non-deprecated msal search API (msal)

1.3.0 (2025-02-17)

• Update to current msal API when requesting an ID token

1.2.1 (2024-03-28)

• Dilligently close file handles

1.2.0 (2024-03-21)

• Preserve query parameters in redis url

1.1.0 (2021-07-28)

• Add get_access_token method, make scopes configurable
• Implement redis cache

1.0.0 (2021-07-23)

• Initial release