pyop
OpenID Connect Provider (OP) library in Python.
Decision gist · record as of 2026-08-14
Yes. pyOP is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. It is suitable for building OpenID Connect providers when you need fine-grained control over authentication logic and storage. Choose it if you are building a custom identity provider or integrating OIDC into an existing web application; avoid it if you need a turnkey, fully managed provider or if your framework already includes built-in OIDC support.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires a signing key (RSA) and backend storage (e.g., MongoDB) to be configured before the provider can be instantiated.
- Low install friction with a pure-Python wheel distribution.
- Active maintenance with a recent commit on 2026-08-04 and a release on 2025-09-03.
License · maintenance · safety
Apache 2.0 (permissive) — Licensed under Apache 2.0 (permissive), allowing commercial use, modification, and distribution with minimal restrictions—suitable for most deployment scenarios.
last release 2025-09-03 (345 days) · last repo commit 2026-08-04 · 100 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 239,476 downloads/mo, #8,921 on PyPI
Alternatives
Verify before relying
pip install pyop
from pyop.provider import Provider
from pyop.authz_state import AuthorizationState
from pyop.userinfo import Userinfo
provider = Provider(signing_key, configuration_information, authz_state, client_db, Userinfo(user_db))- Whether the library supports Python versions beyond what the fact sheet specifies (requires_python is unspecified).
- Current production deployment scale and real-world reliability metrics beyond the 100 GitHub stars.
- Whether pycryptodomex is a required runtime dependency or an optional one for crypto operations.
What it is and what it does
pyOP is a high-level OpenID Connect Provider library that abstracts the core protocol logic so web applications can implement custom authentication mechanisms while delegating token and message handling to the library. It supports the major OpenID Connect flows (Authorization Code, Implicit, Hybrid), dynamic provider discovery and client registration, and signed ID token issuance. The library depends on oic (the underlying OpenID Connect protocol layer) and pycryptodomex (for cryptographic operations) and is designed to work with any web framework by providing a simple interface for parsing authentication requests, authorizing users, and publishing provider configuration.
Typical usage involves configuring a Provider instance with signing keys, endpoint URLs, and a backend storage layer (such as MongoDB via the included MongoWrapper), then integrating it into your web application's authorization, token, and userinfo endpoints. The library handles the OpenID Connect message validation and construction, while your application retains full control over user authentication, session management, and data storage.
Use it for
- Build a federated identity provider that accepts authentication from multiple upstream sources while issuing OpenID Connect tokens to client applications.
- Implement an internal single sign-on (SSO) system where a central provider issues ID tokens and access tokens to multiple internal web services.
- Create a bridge between legacy authentication systems and modern OpenID Connect clients by wrapping existing user databases with pyOP's provider interface.
- Deploy a standards-compliant OIDC provider for a SaaS platform to allow third-party applications to authenticate users without managing passwords.
- Integrate OpenID Connect into a custom web framework by using pyOP's core message handling and token lifecycle management.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
pyOP is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. It is suitable for building OpenID Connect providers when you need fine-grained control over authentication logic and storage. Choose it if you are building a custom identity provider or integrating OIDC into an existing web application; avoid it if you need a turnkey, fully managed provider or if your framework already includes built-in OIDC support.
Install
pyop on PyPI
Before you install
Low install friction with a pure-Python wheel distribution. Active maintenance with a recent commit on 2026-08-04 and a release on 2025-09-03. Two runtime dependencies (oic and pycryptodomex) are both well-established packages.
Requires a signing key (RSA) and backend storage (e.g., MongoDB) to be configured before the provider can be instantiated.
License in practice
Licensed under Apache 2.0 (permissive), allowing commercial use, modification, and distribution with minimal restrictions—suitable for most deployment scenarios.
Quickstart
pip install pyop
from pyop.provider import Provider
from pyop.authz_state import AuthorizationState
from pyop.userinfo import Userinfo
provider = Provider(signing_key, configuration_information, authz_state, client_db, Userinfo(user_db))Verify before relying
- Whether the library supports Python versions beyond what the fact sheet specifies (requires_python is unspecified).
- Current production deployment scale and real-world reliability metrics beyond the 100 GitHub stars.
- Whether pycryptodomex is a required runtime dependency or an optional one for crypto operations.
Package facts
| License | Apache 2.0 permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesoicpycryptodomex |
| Maintenance | Actively maintained 345 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 239,476 / month, #8,921 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
Evidence: pyop-3.4.2-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “openid connect provider”
- pyopImplements an OpenID Connect Provider (OP) library that handles…
- oidc-provider-mockA mock OpenID Connect provider server that runs locally to test and…
- oicA complete Python implementation of OpenID Connect and OAuth 2.0…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also oic · oidc-provider-mock · django-oidc-provider · flask-oidc · python-keycloak · intuit-oauth · Authlib · requests-oauth2client · python3-openid · mozilla-django-oidc