Flask-JWT-Extended

What it is and what it does

Flask-JWT-Extended is a Flask extension that integrates JSON Web Token authentication into your application. It wraps PyJWT and Werkzeug to provide decorators and utilities for protecting routes, validating tokens, and managing token state. The package handles the boilerplate of JWT setup so you can focus on application logic rather than cryptographic details.

Beyond basic token creation and validation, it offers optional features like refresh tokens (for long-lived sessions without re-authentication), token blocklisting (revocation), custom claims validation, fresh-token enforcement for sensitive operations, and cookie-based storage with CSRF protection. You configure it once on your Flask app and then use decorators like `@jwt_required()` on routes that need authentication.

Use it for:

• Protect REST API endpoints by requiring valid JWT tokens in request headers before allowing access.
• Implement login flows with separate access and refresh tokens to balance security and user experience.
• Revoke tokens on logout or when user permissions change by maintaining a blocklist.
• Add custom claims (user roles, permissions) to tokens and validate them on each request.
• Enforce fresh tokens for sensitive operations like password changes or account deletions.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds JSON Web Token (JWT) authentication to Flask applications, protecting routes and managing token lifecycles with features like refresh tokens, token revocation, and custom claims.

Yes. Flask-JWT-Extended is actively maintained, has no known vulnerabilities, low install friction, and a permissive MIT license. It is a standard choice for JWT authentication in Flask applications and is widely used (top 5000 packages by downloads). Install it if you need JWT authentication in Flask; the API is straightforward and the optional features are genuinely useful for production applications.

Install

flask-jwt-extended on PyPI

pip install flask-jwt-extended

uv add flask-jwt-extended

poetry add flask-jwt-extended

Installing Flask-JWT-Extended

Before you install

Low install friction with a pure-Python wheel distribution. Actively maintained as of 2026-07-02 with recent releases; the project has 1581 stars and follows semantic versioning.

License in practice

MIT license (permissive) allows use in commercial and private projects with minimal restrictions; attribution is required but no copyleft obligations apply.

Quickstart

pip install flask-jwt-extended

from flask import Flask
from flask_jwt_extended import JWTManager, create_access_token

app = Flask(__name__)
app.config['JWT_SECRET_KEY'] = 'your-secret-key'
jwt = JWTManager(app)

access_token = create_access_token(identity='user_id')

Requires Python 3.10 or later; earlier Python 3.x versions (3.6–3.9) are not supported by this release.

Verify before relying

• Whether the package's optional features (cookie storage, CSRF protection, automatic user loading) require additional dependencies beyond the three listed runtime deps.
• Performance characteristics when handling high token volumes or large custom claims payloads.
• Real-world security audit status or known attack vectors specific to this implementation.

Package facts

Evidence: flask_jwt_extended-4.7.4-py2.py3-none-any.whl

Keywords: flask, jwt, json web token

Tags

More Python Modules packages