pymacaroons
Macaroon library for Python
Decision gist · record as of 2026-08-14
Yes, if you need macaroon support and can accept dormant maintenance. The package is stable, has no known vulnerabilities, and low install friction. However, if you require active development, recent Python version support beyond 3.9, or performance-critical use, consider whether libmacaroons bindings or an alternative bearer token scheme better fits your needs.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Installation is straightforward with low friction.
- The package is dormant—last release was in 2018 and the last commit in 2024—but the repository remains active and the implementation is considered stable by its maintainers.
License · maintenance · safety
MIT (permissive) — Licensed under MIT (permissive), so you can use, modify, and distribute PyMacaroons with minimal legal restriction.
last release 2018-02-21 (3096 days) · last repo commit 2024-02-21 · 83 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 1,015,507 downloads/mo, #4,502 on PyPI
Alternatives
Verify before relying
from pymacaroons import Macaroon, Verifier
m = Macaroon(
location='service.example.com',
identifier='key-id',
key='secret-signing-key'
)
m.add_first_party_caveat('resource = photo.jpg')
serialized = m.serialize()
v = Verifier()
v.satisfy_exact('resource = photo.jpg')
verified = v.verify(m, 'secret-signing-key')- Whether the package works reliably with modern Python versions beyond 3.9 (CI builds mentioned 2.7, 3.5–3.9, and PyPy3, but no recent test coverage documented)
- Performance characteristics compared to libmacaroons or other bearer token schemes in production scenarios
What it is and what it does
PyMacaroons is a pure-Python implementation of macaroons, a cryptographic authorization primitive that works like bearer tokens but with embedded authorization constraints called caveats. Unlike opaque tokens, macaroons allow the issuing service to embed specific authorization rules directly into the credential—for example, restricting access to a particular resource or time window—without requiring a separate lookup. The verifier can then check both the cryptographic integrity of the macaroon and whether all embedded caveats are satisfied in the current context.
The library depends on PyNaCl for cryptographic operations and six for Python 2/3 compatibility. It is designed for portability and ease of installation, trading some speed for the convenience of a pure-Python implementation. The package is stable and dormant, with no active development but a maintained repository; it is suitable for systems that need macaroon support and can tolerate the lack of recent updates.
Use it for
- Issue time-limited or resource-scoped bearer tokens for API access without maintaining a separate authorization database.
- Delegate authorization to third parties by creating attenuated macaroons with additional caveats that restrict what the delegate can do.
- Verify incoming credentials in a service by checking both the signature and the satisfaction of all embedded authorization constraints.
- Implement decoupled authorization policy where rules are embedded in the token itself rather than enforced centrally.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need macaroon support and can accept dormant maintenance.
The package is stable, has no known vulnerabilities, and low install friction. However, if you require active development, recent Python version support beyond 3.9, or performance-critical use, consider whether libmacaroons bindings or an alternative bearer token scheme better fits your needs.
Install
pymacaroons on PyPI
Before you install
Installation is straightforward with low friction. The package is dormant—last release was in 2018 and the last commit in 2024—but the repository remains active and the implementation is considered stable by its maintainers.
License in practice
Licensed under MIT (permissive), so you can use, modify, and distribute PyMacaroons with minimal legal restriction.
Quickstart
from pymacaroons import Macaroon, Verifier
m = Macaroon(
location='service.example.com',
identifier='key-id',
key='secret-signing-key'
)
m.add_first_party_caveat('resource = photo.jpg')
serialized = m.serialize()
v = Verifier()
v.satisfy_exact('resource = photo.jpg')
verified = v.verify(m, 'secret-signing-key')Verify before relying
- Whether the package works reliably with modern Python versions beyond 3.9 (CI builds mentioned 2.7, 3.5–3.9, and PyPy3, but no recent test coverage documented)
- Performance characteristics compared to libmacaroons or other bearer token schemes in production scenarios
Package facts
| License | MIT permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesPyNaClsix |
| Maintenance | Dormant 3,096 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 1,015,507 / month, #4,502 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaEnvironment :: Web EnvironmentIntended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 2Programming Language :: Python :: 2.6Programming Language :: Python :: 2.7Programming Language :: Python :: 3Programming Language :: Python :: 3.3Programming Language :: Python :: 3.4Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Internet :: WWW/HTTPTopic :: SecurityTopic :: Security :: Cryptography |
Evidence: pymacaroons-0.13.0-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “macaroon bearer token library”
- pymacaroonsPyMacaroons implements macaroons—bearer credentials with embedded…
- macaroonbakeryMacaroonbakery provides HTTP authentication and cookie handling for…
- auth0-api-pythonVerifies Auth0-issued access tokens and secures Python APIs with…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also macaroonbakery · pycookiecheat · josepy · drf-jwt · django-allauth · propelauth-py · scitokens · jose · aws-bedrock-token-generator · standardwebhooks