---
id: pymacaroons
version: "0.13.0"
license: MIT
license_treatment: permissive
maintenance: dormant
---

# pymacaroons — Macaroon library for Python

License: permissive · Maintenance: dormant · Downloads: 1.0M/mo

## What it is and what it does

PyMacaroons is a pure-Python implementation of macaroons, a cryptographic authorization primitive that works like bearer tokens but with embedded authorization constraints called caveats. Unlike opaque tokens, macaroons allow the issuing service to embed specific authorization rules directly into the credential—for example, restricting access to a particular resource or time window—without requiring a separate lookup. The verifier can then check both the cryptographic integrity of the macaroon and whether all embedded caveats are satisfied in the current context.

The library depends on PyNaCl for cryptographic operations and six for Python 2/3 compatibility. It is designed for portability and ease of installation, trading some speed for the convenience of a pure-Python implementation. The package is stable and dormant, with no active development but a maintained repository; it is suitable for systems that need macaroon support and can tolerate the lack of recent updates.

Use it for:

- Issue time-limited or resource-scoped bearer tokens for API access without maintaining a separate authorization database.
- Delegate authorization to third parties by creating attenuated macaroons with additional caveats that restrict what the delegate can do.
- Verify incoming credentials in a service by checking both the signature and the satisfaction of all embedded authorization constraints.
- Implement decoupled authorization policy where rules are embedded in the token itself rather than enforced centrally.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

PyMacaroons implements macaroons—bearer credentials with embedded authorization caveats that can be created, serialized, and cryptographically verified.

Yes, if you need macaroon support and can accept dormant maintenance. The package is stable, has no known vulnerabilities, and low install friction. However, if you require active development, recent Python version support beyond 3.9, or performance-critical use, consider whether libmacaroons bindings or an alternative bearer token scheme better fits your needs.

## Install

pip install pymacaroons
uv add pymacaroons
poetry add pymacaroons

## Installing pymacaroons

Before you install: Installation is straightforward with low friction. The package is dormant—last release was in 2018 and the last commit in 2024—but the repository remains active and the implementation is considered stable by its maintainers.

License in practice: Licensed under MIT (permissive), so you can use, modify, and distribute PyMacaroons with minimal legal restriction.

Quickstart:

from pymacaroons import Macaroon, Verifier

m = Macaroon(
    location='service.example.com',
    identifier='key-id',
    key='secret-signing-key'
)
m.add_first_party_caveat('resource = photo.jpg')
serialized = m.serialize()

v = Verifier()
v.satisfy_exact('resource = photo.jpg')
verified = v.verify(m, 'secret-signing-key')

Verify before relying:

- Whether the package works reliably with modern Python versions beyond 3.9 (CI builds mentioned 2.7, 3.5–3.9, and PyPy3, but no recent test coverage documented)
- Performance characteristics compared to libmacaroons or other bearer token schemes in production scenarios

## Package facts

- License: MIT (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: dormant
- Downloads: 1.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

macaroon bearer token library, cryptographic authorization credentials, caveat-based access control, macaroon serialization verification, delegated authorization tokens, macaroon cookie alternative, bearer-tokens, authorization-caveats

[View on SkillFed](https://skillfed.io/packages/pymacaroons) · [View on PyPI](https://pypi.org/project/pymacaroons/)