---
id: keystonemiddleware
version: "13.0.0"
license: unclear
license_treatment: permissive
maintenance: active
---

# keystonemiddleware — Middleware for OpenStack Identity

License: permissive · Maintenance: active · Downloads: 344.0K/mo

## What it is and what it does

Keystonemiddleware is a WSGI middleware package that integrates OpenStack Keystone identity services into web applications. It provides the auth_token module, which intercepts requests, validates tokens against a Keystone server, and injects authentication context into the application. The package is designed for OpenStack deployments where services need to verify user identity and authorization without implementing their own token handling.

The middleware relies on a substantial set of dependencies—including keystoneauth1 for Keystone communication, oslo libraries for configuration and logging, PyJWT for token processing, and WebOb for WSGI integration. It does not expose CLI or Python API features; instead, it operates as a transparent request filter in the WSGI pipeline. Typical use involves configuring it with Keystone endpoint details and letting it validate incoming tokens before passing requests to the protected application.

Use it for:

- Protect OpenStack API services by validating Keystone tokens on every incoming request.
- Integrate identity and authorization context into custom OpenStack-aware web applications.
- Enforce role-based access control by extracting user roles from validated Keystone tokens.
- Delegate authentication to a centralized Keystone server across multiple microservices.
- Add token caching and validation retry logic to reduce latency in token verification.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides authentication and authorization middleware for OpenStack web services through token validation against the Keystone identity service.

Yes, if you are building or deploying services within an OpenStack environment that requires Keystone authentication. The package is actively maintained, has no known vulnerabilities, and is the standard middleware for this purpose. Not applicable outside OpenStack deployments.

## Install

pip install keystonemiddleware
uv add keystonemiddleware
poetry add keystonemiddleware

## Installing keystonemiddleware

Before you install: Low friction installation with a pure-Python wheel distribution. Actively maintained with a recent release (93 days ago). Requires Python 3.10 or later and depends on 14 runtime packages including keystoneauth1, oslo libraries, and PyJWT.

License in practice: Licensed under Apache License 2.0 (permissive). Suitable for use in commercial and open-source projects with standard attribution requirements.

Quickstart:

pip install keystonemiddleware

from keystonemiddleware import auth_token

app = auth_token.AuthProtocol(application, {'oslo_config_config': cfg.CONF})

Requires Python 3.10 or later; designed for integration into WSGI applications, not standalone use.

Verify before relying:

- Whether keystonemiddleware works with Keystone versions other than the current release cycle.
- Performance characteristics under high token validation load.
- Compatibility with non-WSGI frameworks or async application servers.

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 344.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

openstack keystone middleware, token authentication middleware, openstack identity integration, keystone auth token validation, openstack service authentication, identity middleware wsgi, keystone token middleware, openstack, authentication, wsgi-middleware

[View on SkillFed](https://skillfed.io/packages/keystonemiddleware) · [View on PyPI](https://pypi.org/project/keystonemiddleware/)