---
id: flask-httpauth
version: "4.8.1"
license: unclear
license_treatment: permissive
maintenance: active
---

# Flask-HTTPAuth — HTTP authentication for Flask routes

License: permissive · Maintenance: active · Downloads: 2.6M/mo

## What it is and what it does

Flask-HTTPAuth is a lightweight extension that adds HTTP authentication to Flask applications. It provides decorators for three standard authentication schemes—Basic, Digest, and Token—allowing you to protect individual routes or groups of routes with credential verification. You define a callback function to validate credentials against a database or in-memory store, then decorate your route handlers with @auth.login_required to enforce authentication.

The package integrates directly with Flask's request handling and works with standard HTTP authentication protocols. It's designed for straightforward authentication needs in REST APIs and web applications where you want to avoid the overhead of session management or third-party OAuth providers. The extension handles the HTTP protocol details—parsing Authorization headers and managing authentication state—so you focus only on credential validation logic.

Use it for:

- Protect REST API endpoints with Basic authentication for internal tools or third-party integrations.
- Add Digest authentication to web services where credentials must not be sent in plaintext.
- Implement Token-based authentication for mobile apps or single-page applications.
- Secure administrative routes in Flask applications with simple decorator-based access control.
- Build microservices that require lightweight HTTP authentication without external identity providers.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Adds HTTP Basic, Digest, and Token authentication decorators to Flask routes, protecting endpoints with standard credential verification.

Yes. Flask-HTTPAuth is a mature, actively maintained package with no known vulnerabilities, permissive licensing, and minimal install friction. It solves a common problem—protecting Flask routes with standard HTTP authentication—directly and without unnecessary dependencies. Install it when you need straightforward Basic, Digest, or Token auth and want to avoid building authentication from scratch.

## Install

pip install flask-httpauth
uv add flask-httpauth
poetry add flask-httpauth

## Installing Flask-HTTPAuth

Before you install: Low friction install with a single runtime dependency on flask. Active maintenance with a recent release and steady repository activity.

License in practice: MIT license permits unrestricted use, modification, and distribution with minimal obligations.

Quickstart:

pip install Flask-HTTPAuth

from flask import Flask
from flask_httpauth import HTTPBasicAuth

app = Flask(__name__)
auth = HTTPBasicAuth()
users = {"john": "hello"}

@auth.verify_password
def verify_password(username, password):
    if username in users and users[username] == password:
        return username

@app.route('/')
@auth.login_required
def index():
    return "Hello, %s!" % auth.current_user()

Verify before relying:

- Whether password hashing utilities are included or require a separate dependency for production use.
- Specific HTTP status codes returned by authentication failures.

## Package facts

- License: not declared (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 2.6M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flask http authentication, basic auth for flask, digest authentication decorator, token auth flask, http auth middleware flask, password protection flask routes, flask login decorator, http-auth, flask-extension, security

[View on SkillFed](https://skillfed.io/packages/flask-httpauth) · [View on PyPI](https://pypi.org/project/flask-httpauth/)