{"categories":[{"label":"Python Modules","url":"https://skillfed.io/packages/category/software-development-libraries-python-modules/20"}],"enrichment":{"capability":"An HTTP authorization service that answers whether a user may perform an action, using role-based access control without handling authentication, passwords, or tokens.","skillfed_tags":["rbac","authorization-service","multi-tenant"],"use_cases":["Gate microservice endpoints on whether a caller holds a required role and permission without embedding auth logic in each service.","Manage CLI tool access by checking user roles and permissions before executing privileged commands.","Implement workflow engine authorization by verifying that a user can transition a task to the next stage.","Provide a multi-tenant SaaS application with isolated role hierarchies and permission checks per customer namespace.","Audit and rotate user access by revoking API keys or removing role memberships without redeploying services."],"what_it_does":"auth is a dedicated HTTP service for role-based access control that centralizes authorization logic so your services don't reinvent roles and permissions. It answers a single question\u2014may user X do Y\u2014by checking whether a user holds a role that grants a permission. It is strictly authorization: it does not authenticate users, store passwords, or issue tokens. Instead, it trusts that callers already know who the user is and decides what they may do based on a simple model: user \u2192 role \u2192 permission.\n\nYou interact with it via HTTP endpoints or a Python client. Each client uses a UUID4 key as a private namespace. You create roles, assign permissions to roles, create user identities (optionally backed by API keys), and add users to roles. When you need to check access, you query whether a user has a permission. Since version 3.0.0, new namespaces enforce strict user identity\u2014users must hold an API key before receiving roles\u2014though existing namespaces and opt-out are supported indefinitely.","worth_installing":"Yes, if you need centralized RBAC for multiple services or want to avoid reinventing role and permission logic. The low install friction, active maintenance, MIT license, and zero known vulnerabilities support adoption. However, you must run or access an auth service instance\u2014it is not an in-process library\u2014and you need to understand that it handles authorization only, not authentication. Not suitable if you need fine-grained attribute-based access control or cannot tolerate a network round-trip per permission check."},"id":"auth","links":{"html":"https://skillfed.io/packages/auth","md":"https://skillfed.io/packages/auth.md","pypi":"https://pypi.org/project/auth/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-08-12","license_spdx":"MIT","license_treatment":"permissive","name":"auth","python_support":"supports_current","summary":"Authorization for humans"},"popularity":{"monthly_downloads":94779,"position":13305,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"3.1.0"}