The problem
Every Python web app eventually needs authentication, and every team ends up either gluing together half a dozen libraries or hand-rolling JWT logic. Both paths are full of security traps: weak token validation, no refresh-token rotation, missing lockouts, forgotten MFA.
The library
authority-auth (https://github.com/rkriad585/authority) is a comprehensive, framework-agnostic Python authentication library. One core, written to be used from any stack:
- **JWT **access tokens with configurable expiry
- Refresh-token rotation with family tracking and reuse detection
- TOTP MFA with encrypted secrets and one-time recovery codes
- WebAuthn passkeys for passwordless login
- RBAC (roles/permissions) with a require_permission guard
- API keys, session management, and append-only audit logging
- Password security: bcrypt hashing, complexity rules, history enforcement, and HIBP breach checking
Framework integrations
It ships ready-made integrations for FastAPI, Flask, Django, and Starlette, plus framework-agnostic ASGI and WSGI middleware for anything else. Storage is pluggable, with SQLite (sync and async) included.
Example apps you can actually run
Since 0.2.5, every example app is a real web app — server-rendered HTML pages (login, register, dashboard) plus a JSON API, with an HttpOnly-cookie login flow. Run python -m examples.apps.fastapi_app.app (or the Flask/Django/Starlette variants) and poke around.
Get started
pip install authority-auth
Docs: rkriad585.github.io/authority (https://rkriad585.github.io/authority/) · MIT licensed · Python 3.10+
Top comments (0)