Authlib

The ultimate Python library in building OAuth and OpenID Connect servers and clients.

authlib Permissive license BSD-3-Clause Active v1.7.2 released 2026-05-06

Install

authlib on PyPI

pip

pip install authlib

uv

uv add authlib

poetry

poetry add authlib

Package facts

License	BSD-3-Clause (permissive)
Python support	supports the current Python release (>=3.10)
Install friction	low — pure-Python wheel
Runtime dependencies	2 — cryptography, joserfc
Maintenance	actively maintained — 99 days since the last release
First released	2017-11-18
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: authlib-1.7.2-py2.py3-none-any.whl

Development Status :: 5 - Production/StableEnvironment :: ConsoleEnvironment :: Web EnvironmentIntended Audience :: DevelopersLicense :: OSI Approved :: BSD LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Internet :: WWW/HTTP :: Dynamic ContentTopic :: Internet :: WWW/HTTP :: WSGI :: ApplicationTopic :: SecurityTopic :: Security :: Cryptography

About Authlib

from the package's own PyPI description — quoted content, verbatim

Build Status (image) PyPI version (image) conda-forge version (image) PyPI Downloads (image) Code Coverage (image) Maintainability Rating (image)

</div>

The ultimate Python library in building OAuth and OpenID Connect servers. JWS, JWK, JWA, JWT are included.

Authlib is compatible with Python3.10+.

Migrations

Authlib will deprecate...

Read as markdown · JSON record · Source repository · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Authlib is a comprehensive Python library for building OAuth 1.0, OAuth 2.0, and OpenID Connect servers and clients, with integrated support for JWT, JWS, JWK, and JWA standards.

Low friction install with only two runtime dependencies (cryptography and joserfc). Actively maintained with a recent release 99 days ago; supports Python 3.10–3.14 and PyPy.

BSD-3-Clause permissive license allows commercial and private use with minimal restrictions; attribution required but no copyleft obligations.

Usage

pip install authlib

from authlib.oauth2 import OAuth2Request
from authlib.jose import jwt

token = jwt.encode({'sub': 'user'}, 'secret')

Requires Python 3.10 or later; cryptography and joserfc must be installed as runtime dependencies.

Verdict: Authlib is a mature, actively maintained library with broad OAuth/OpenID Connect coverage and low install friction. No known vulnerabilities, permissive licensing, and strong spec compliance make it suitable for production authentication systems. The deprecation of authlib.jose in favor of joserfc is noted in the documentation.

Needs verification

Whether the deprecation of authlib.jose affects current users and what the migration timeline is
Performance characteristics and scalability limits for high-throughput OAuth server deployments
Specific security audit history or third-party security review status

oauth server implementationopenid connect providerjwt token handlingoauth2 client libraryauthentication framework pythonjose jwt jws jweoauth1 oauth2 protocol