---
id: auth
version: "3.1.0"
license: MIT
license_treatment: permissive
maintenance: active
---

# auth — Authorization for humans

License: permissive · Maintenance: active · Downloads: 94.8K/mo

## What it is and what it does

auth is a dedicated HTTP service for role-based access control that centralizes authorization logic so your services don't reinvent roles and permissions. It answers a single question—may user X do Y—by checking whether a user holds a role that grants a permission. It is strictly authorization: it does not authenticate users, store passwords, or issue tokens. Instead, it trusts that callers already know who the user is and decides what they may do based on a simple model: user → role → permission.

You interact with it via HTTP endpoints or a Python client. Each client uses a UUID4 key as a private namespace. You create roles, assign permissions to roles, create user identities (optionally backed by API keys), and add users to roles. When you need to check access, you query whether a user has a permission. Since version 3.0.0, new namespaces enforce strict user identity—users must hold an API key before receiving roles—though existing namespaces and opt-out are supported indefinitely.

Use it for:

- Gate microservice endpoints on whether a caller holds a required role and permission without embedding auth logic in each service.
- Manage CLI tool access by checking user roles and permissions before executing privileged commands.
- Implement workflow engine authorization by verifying that a user can transition a task to the next stage.
- Provide a multi-tenant SaaS application with isolated role hierarchies and permission checks per customer namespace.
- Audit and rotate user access by revoking API keys or removing role memberships without redeploying services.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

An HTTP authorization service that answers whether a user may perform an action, using role-based access control without handling authentication, passwords, or tokens.

Yes, if you need centralized RBAC for multiple services or want to avoid reinventing role and permission logic. The low install friction, active maintenance, MIT license, and zero known vulnerabilities support adoption. However, you must run or access an auth service instance—it is not an in-process library—and you need to understand that it handles authorization only, not authentication. Not suitable if you need fine-grained attribute-based access control or cannot tolerate a network round-trip per permission check.

## Install

pip install auth
uv add auth
poetry add auth

## Installing auth

Before you install: Low install friction with a pure-Python wheel. Actively maintained with a release 2 days old. Supports Python 3.9 through 3.14. Depends on 12 runtime packages including Flask, SQLAlchemy, and cryptography—a moderate but standard stack for a web service.

License in practice: MIT license permits free use, modification, and distribution with minimal restrictions, making it suitable for both open-source and commercial projects.

Quickstart:

from auth import Client

KEY = "your-uuid4-key-here"
with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
    c.create_role("engineers")
    c.add_permission("engineers", "deploy")
    c.create_api_key("alice")
    c.add_membership("alice", "engineers")
    result = c.user_has_permission("alice", "deploy")

Requires a running auth service instance (self-hosted or external). Since 3.0.0, new namespaces require users to hold an API key before role assignment; existing namespaces were grandfathered with key-less user support.

Verify before relying:

- Performance characteristics under high permission-check volume or with large role/permission graphs
- Exact latency overhead of network round-trips versus in-process caching strategies
- Multi-tenancy isolation guarantees and audit trail completeness

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 94.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

role-based access control service, RBAC authorization HTTP API, permission checking service, user role membership management, authorization without authentication, distributed permission engine, role permission delegation, rbac, authorization-service, multi-tenant

[View on SkillFed](https://skillfed.io/packages/auth) · [View on PyPI](https://pypi.org/project/auth/)