pyjwt-key-fetcher

What it is and what it does

pyjwt-key-fetcher is an async wrapper around JWT key verification that automates the process of discovering and fetching signing keys from OpenID Connect providers. Instead of manually managing JWKS endpoints, you pass a token to AsyncKeyFetcher.get_key(), and it extracts the issuer and key ID, fetches the provider's configuration from .well-known/openid-configuration, retrieves the JWKS from the jwks_uri, and returns the matching key for use with PyJWT's decode function.

The library caches configuration and keys by default for up to 32 issuers with a 1-hour TTL, and re-fetches JWKs within 5 minutes if an unknown key ID appears for a known issuer. You can customize cache size, TTL, configuration paths, and provide static issuer configurations for providers that don't expose standard endpoints. It ships with aiohttp-based HTTP fetching but allows custom HTTP client implementations.

Use it for:

• Verify JWTs from multiple OpenID Connect providers in a microservice without hardcoding key endpoints.
• Build an API gateway that validates tokens from external identity providers with automatic key rotation.
• Implement token validation in async web frameworks (FastAPI, aiohttp) where blocking I/O is unacceptable.
• Cache and reuse JWKS across many concurrent requests to reduce latency and provider load.
• Support custom issuer configurations for non-standard or internal OpenID providers.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Async library that automatically fetches and caches JSON Web Keys (JWKs) from OpenID Connect providers to verify JWT tokens, acting as a replacement for PyJWT's PyJWKClient.

Yes, if you need async JWT validation against OpenID Connect providers. The library solves a real problem (automatic key discovery and caching) and integrates cleanly with PyJWT. Install friction is low and dependencies are solid. The aging maintenance status (last release 2024-08-07, no recent commits) is a minor concern for a stable utility, but no known vulnerabilities and active repository status mitigate that risk. Suitable for production use in async applications.

Install

pyjwt-key-fetcher on PyPI

pip install pyjwt-key-fetcher

uv add pyjwt-key-fetcher

poetry add pyjwt-key-fetcher

Installing pyjwt-key-fetcher

Before you install

Low friction install with a pure-wheel distribution. Maintenance is aging—last release was 2024-08-07 and the repository shows no recent commits, though it remains active and not archived. Four runtime dependencies (PyJWT, aiohttp, cachetools, aiocache) are all well-established libraries.

License in practice

BSD-3-Clause is permissive and places no restrictions on commercial or proprietary use, making it suitable for most projects without license compliance burden.

Quickstart

pip install pyjwt-key-fetcher

import asyncio
from pyjwt_key_fetcher import AsyncKeyFetcher

async def main():
    fetcher = AsyncKeyFetcher()
    key_entry = await fetcher.get_key(token)

asyncio.run(main())

Requires Python 3.8 or later and an async runtime context (asyncio or similar).

Verify before relying

• Whether the 5-minute re-fetch interval for new keys is configurable in practice or only via source modification.
• Performance characteristics when caching across many issuers or under high concurrency.
• Whether custom HTTP clients can be used with non-standard authentication schemes (mTLS, proxies, etc.).

Package facts

Evidence: pyjwt_key_fetcher-0.8.0-py3-none-any.whl

Tags

More Cryptography packages