pyop

What it is and what it does

pyOP is a high-level OpenID Connect Provider library that abstracts the core protocol logic so web applications can implement custom authentication mechanisms while delegating token and message handling to the library. It supports the major OpenID Connect flows (Authorization Code, Implicit, Hybrid), dynamic provider discovery and client registration, and signed ID token issuance. The library depends on oic (the underlying OpenID Connect protocol layer) and pycryptodomex (for cryptographic operations) and is designed to work with any web framework by providing a simple interface for parsing authentication requests, authorizing users, and publishing provider configuration.

Typical usage involves configuring a Provider instance with signing keys, endpoint URLs, and a backend storage layer (such as MongoDB via the included MongoWrapper), then integrating it into your web application's authorization, token, and userinfo endpoints. The library handles the OpenID Connect message validation and construction, while your application retains full control over user authentication, session management, and data storage.

Use it for:

• Build a federated identity provider that accepts authentication from multiple upstream sources while issuing OpenID Connect tokens to client applications.
• Implement an internal single sign-on (SSO) system where a central provider issues ID tokens and access tokens to multiple internal web services.
• Create a bridge between legacy authentication systems and modern OpenID Connect clients by wrapping existing user databases with pyOP's provider interface.
• Deploy a standards-compliant OIDC provider for a SaaS platform to allow third-party applications to authenticate users without managing passwords.
• Integrate OpenID Connect into a custom web framework by using pyOP's core message handling and token lifecycle management.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Implements an OpenID Connect Provider (OP) library that handles authentication flows, token management, and provider configuration for web applications.

Yes. pyOP is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. It is suitable for building OpenID Connect providers when you need fine-grained control over authentication logic and storage. Choose it if you are building a custom identity provider or integrating OIDC into an existing web application; avoid it if you need a turnkey, fully managed provider or if your framework already includes built-in OIDC support.

Install

pyop on PyPI

pip install pyop

uv add pyop

poetry add pyop

Installing pyop

Before you install

Low install friction with a pure-Python wheel distribution. Active maintenance with a recent commit on 2026-08-04 and a release on 2025-09-03. Two runtime dependencies (oic and pycryptodomex) are both well-established packages.

License in practice

Licensed under Apache 2.0 (permissive), allowing commercial use, modification, and distribution with minimal restrictions—suitable for most deployment scenarios.

Quickstart

pip install pyop

from pyop.provider import Provider
from pyop.authz_state import AuthorizationState
from pyop.userinfo import Userinfo

provider = Provider(signing_key, configuration_information, authz_state, client_db, Userinfo(user_db))

Requires a signing key (RSA) and backend storage (e.g., MongoDB) to be configured before the provider can be instantiated.

Verify before relying

• Whether the library supports Python versions beyond what the fact sheet specifies (requires_python is unspecified).
• Current production deployment scale and real-world reliability metrics beyond the 100 GitHub stars.
• Whether pycryptodomex is a required runtime dependency or an optional one for crypto operations.

Package facts

Evidence: pyop-3.4.2-py3-none-any.whl

Tags

More WWW/HTTP packages