---
id: flask-security
version: "5.8.2"
license: unclear
license_treatment: permissive
maintenance: active
---

# Flask-Security — Quickly add security features to your Flask application.

License: permissive · Maintenance: active · Downloads: 158.2K/mo

## What it is and what it does

Flask-Security is a Flask extension that bundles authentication, authorization, and user management into a single package. It provides ready-to-use features for user registration, login, password reset, role-based access control, and modern authentication standards like OAuth social login, WebAuthn/passkey support, and multi-factor authentication via SMS, email, or authenticator apps. The package is designed around OWASP best practices and reduces reliance on abandoned dependencies by bundling common use cases.

The extension integrates with Flask-Login for session management, Flask-Principal for authorization, Flask-WTF for form security, and email-validator for email handling. It's actively maintained as part of the Pallets Community Ecosystem (the organization behind Flask itself) and has evolved since its original 2012 release to support modern authentication patterns including unified signin, freshness decorators for sensitive operations, and email normalization.

Use it for:

- Add user registration and login to a Flask web application without building authentication from scratch
- Implement role-based access control to restrict views and resources to specific user groups
- Enable multi-factor authentication (SMS, email, or authenticator apps) for sensitive applications
- Integrate social login (OAuth) so users can sign in via external providers like Google or GitHub
- Support passwordless or username-based authentication as an alternative to email-based login
- Add WebAuthn/passkey support for modern, phishing-resistant authentication

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Flask-Security adds authentication, authorization, and user management to Flask applications, supporting multiple authentication methods including OAuth, WebAuthn, and multi-factor authentication.

Yes. Flask-Security is actively maintained, has no known vulnerabilities, low install friction, and provides a comprehensive, OWASP-aligned authentication and authorization layer for Flask applications. It's suitable for production use and backed by the Pallets Community Ecosystem. Install it if you need to add user management and security features to a Flask app without implementing these systems yourself.

## Install

pip install flask-security
uv add flask-security
poetry add flask-security

## Installing Flask-Security

Before you install: Low install friction with a pure-Python wheel distribution. Actively maintained with a release 2 days ago and recent commits; part of the Pallets Community Ecosystem with 698 repository stars. Requires Python 3.10 or later.

License in practice: Licensed under MIT (permissive), allowing use in commercial and proprietary projects with minimal restrictions.

Quickstart:

pip install Flask-Security

from flask import Flask
from flask_security import Security, SQLAlchemyUserDatastore

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'

# Configure datastore and Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

Requires Python 3.10 or later; typical setup requires a database and SQLAlchemy integration for user/role storage.

Verify before relying:

- Specific OAuth provider support beyond authlib integration mentioned in description
- Performance characteristics under high-concurrency authentication load
- Compatibility matrix with specific Flask and dependency versions beyond Python 3.10+

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 158.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flask authentication authorization, flask user management security, flask login oauth webauthn, flask multi-factor authentication, flask password management, flask role-based access control, flask session management, authentication, authorization, flask-extension

[View on SkillFed](https://skillfed.io/packages/flask-security) · [View on PyPI](https://pypi.org/project/flask-security/)