---
id: keystoneauth1
version: "5.15.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# keystoneauth1 — Authentication Library for OpenStack Identity

License: permissive · Maintenance: active · Downloads: 2.0M/mo

## What it is and what it does

keystoneauth1 is the authentication layer for OpenStack cloud clients. It abstracts the complexity of connecting to OpenStack Identity (Keystone) services by providing ready-made authentication plugins for common credential types—passwords, tokens, and federated identity—plus automatic API version discovery and a session wrapper around the requests library to manage credentials across multiple API calls.

Developers use keystoneauth1 when building tools that interact with OpenStack clouds: it handles credential exchange, token refresh, and endpoint discovery so that higher-level clients (like the OpenStack SDK or individual service clients) can focus on API logic rather than authentication plumbing. The package is maintained as part of the OpenStack project and is a foundational dependency for most OpenStack Python tooling.

Use it for:

- Authenticate to OpenStack clouds from Python scripts or applications using password, token, or federated credentials.
- Build custom OpenStack service clients that need automatic token refresh and endpoint discovery.
- Integrate OpenStack cloud access into CI/CD pipelines or infrastructure-as-code tools.
- Query OpenStack API version support and available endpoints before making service calls.
- Manage multi-cloud authentication when some clouds are OpenStack-based.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides authentication plugins, API discovery, and session management for OpenStack-based cloud services, supporting password, token, and federation-based authentication methods.

Yes, if you are building tools or applications that interact with OpenStack clouds. keystoneauth1 is the standard authentication library for the OpenStack ecosystem, actively maintained, well-integrated with the broader OpenStack Python tooling, and carries no known vulnerabilities. Install it as a dependency of higher-level OpenStack clients or directly if you are writing custom OpenStack integrations.

## Install

pip install keystoneauth1
uv add keystoneauth1
poetry add keystoneauth1

## Installing keystoneauth1

Before you install: Active maintenance with a recent release (42 days ago). Low install friction with five runtime dependencies, all common libraries (iso8601, requests, stevedore, os-service-types, typing-extensions). Supports current Python versions (3.11–3.14).

License in practice: Apache-2.0 permissive license allows use in most commercial and open-source projects with minimal restrictions; attribution required.

Quickstart:

pip install keystoneauth1

from keystoneauth1 import loading
loader = loading.get_plugin_loader('password')
auth = loader.load_from_options(
    auth_url='https://keystone.example.com:5000/v3',
    username='user', password='pass', project_name='project',
    user_domain_name='Default', project_domain_name='Default'
)
session = loading.load_session_from_options(
    conf={}, auth=auth, interface='public'
)

Requires Python 3.11 or later; OpenStack Keystone endpoint URL and valid credentials.

Verify before relying:

- Whether the package's federation authentication methods cover all major OpenStack identity providers
- Performance characteristics under high-volume authentication scenarios
- Compatibility with non-standard or custom OpenStack deployments

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

openstack authentication, openstack keystone client, cloud identity authentication, openstack api session, federation authentication openstack, openstack token management, cloud service discovery, openstack, cloud-auth, identity-management

[View on SkillFed](https://skillfed.io/packages/keystoneauth1) · [View on PyPI](https://pypi.org/project/keystoneauth1/)