Flask-HTTPAuth

What it is and what it does

Flask-HTTPAuth is a lightweight extension that adds HTTP authentication to Flask applications. It provides decorators for three standard authentication schemes—Basic, Digest, and Token—allowing you to protect individual routes or groups of routes with credential verification. You define a callback function to validate credentials against a database or in-memory store, then decorate your route handlers with @auth.login_required to enforce authentication.

The package integrates directly with Flask's request handling and works with standard HTTP authentication protocols. It's designed for straightforward authentication needs in REST APIs and web applications where you want to avoid the overhead of session management or third-party OAuth providers. The extension handles the HTTP protocol details—parsing Authorization headers and managing authentication state—so you focus only on credential validation logic.

Use it for:

• Protect REST API endpoints with Basic authentication for internal tools or third-party integrations.
• Add Digest authentication to web services where credentials must not be sent in plaintext.
• Implement Token-based authentication for mobile apps or single-page applications.
• Secure administrative routes in Flask applications with simple decorator-based access control.
• Build microservices that require lightweight HTTP authentication without external identity providers.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds HTTP Basic, Digest, and Token authentication decorators to Flask routes, protecting endpoints with standard credential verification.

Yes. Flask-HTTPAuth is a mature, actively maintained package with no known vulnerabilities, permissive licensing, and minimal install friction. It solves a common problem—protecting Flask routes with standard HTTP authentication—directly and without unnecessary dependencies. Install it when you need straightforward Basic, Digest, or Token auth and want to avoid building authentication from scratch.

Install

flask-httpauth on PyPI

pip install flask-httpauth

uv add flask-httpauth

poetry add flask-httpauth

Installing Flask-HTTPAuth

Before you install

Low friction install with a single runtime dependency on flask. Active maintenance with a recent release and steady repository activity.

License in practice

MIT license permits unrestricted use, modification, and distribution with minimal obligations.

Quickstart

pip install Flask-HTTPAuth

from flask import Flask
from flask_httpauth import HTTPBasicAuth

app = Flask(__name__)
auth = HTTPBasicAuth()
users = {"john": "hello"}

@auth.verify_password
def verify_password(username, password):
    if username in users and users[username] == password:
        return username

@app.route('/')
@auth.login_required
def index():
    return "Hello, %s!" % auth.current_user()

Verify before relying

• Whether password hashing utilities are included or require a separate dependency for production use.
• Specific HTTP status codes returned by authentication failures.

Package facts

Evidence: flask_httpauth-4.8.1-py3-none-any.whl

Tags

More WWW/HTTP packages