Flask-Security-Too

What it is and what it does

Flask-Security-Too is a Flask extension that bundles authentication, authorization, and user management into a single package. It provides role-based access control, multiple authentication strategies (username/email, OAuth, WebAuthn), multi-factor authentication (SMS, email, authenticator apps), and session management. The package is maintained as part of the Pallets Community Ecosystem and aims to follow OWASP best practices with sensible defaults, reducing the need to wire together multiple abandoned or unmaintained projects.

You configure it by providing your own User and Role models (typically via SQLAlchemy) and then instantiate the Security object with your Flask app and a datastore. It handles login forms, password hashing, permission decorators, and token-based authentication out of the box. The extension supports modern identity patterns like unified signin (username, phone, passwordless) and freshness checks for sensitive operations.

Use it for:

• Build a web application with user registration, login, and role-based access control without writing authentication logic from scratch.
• Add OAuth social login (via authlib) to an existing Flask app to let users sign in with third-party providers.
• Implement multi-factor authentication (SMS, email, or authenticator apps) for applications handling sensitive data.
• Deploy WebAuthn/passkey support for passwordless authentication in modern web applications.
• Enforce permission checks on Flask routes using decorators to restrict access by role or permission.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds user authentication, authorization, and role-based access control to Flask applications with support for multiple authentication methods including OAuth, WebAuthn, and multi-factor authentication.

Yes. This is an actively maintained, permissively licensed extension backed by the Pallets organization (which maintains Flask itself). It has no known vulnerabilities, low install friction, and provides a comprehensive, opinionated security layer that would otherwise require integrating multiple smaller packages. Install it if you need user authentication and authorization in a Flask app and want to avoid the complexity of assembling and maintaining a custom solution.

Install

flask-security-too on PyPI

pip install flask-security-too

uv add flask-security-too

poetry add flask-security-too

Installing Flask-Security-Too

Before you install

Low install friction with a pure-Python wheel distribution. Active maintenance with a release just 2 days old and commits as recent as 2026-08-12. Part of the Pallets Community Ecosystem, which maintains Flask itself, providing institutional backing and alignment with Flask's release and documentation standards.

License in practice

MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart

pip install Flask-Security-Too

from flask import Flask
from flask_security import Security, SQLAlchemyUserDatastore

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'
# Configure datastore with your user and role models
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

Requires Python 3.10 or later. Needs a Flask application instance and a database setup (typically SQLAlchemy) to define User and Role models.

Verify before relying

• Whether all advertised authentication methods (OAuth, WebAuthn, SMS/email MFA, passkeys) are production-ready in version 5.8.2 or still experimental.
• Performance characteristics and scalability limits when handling large numbers of concurrent authentication requests.
• Specific OWASP ASVS requirements that are enforced by default vs. those requiring explicit configuration.

Package facts

Evidence: flask_security_too-5.8.2-py3-none-any.whl

Keywords: flask, security

Tags

More Python Modules packages