requests-oauth2client

What it is and what it does

requests_oauth2client is an OAuth 2.x and OpenID Connect client that extends the requests HTTP library to handle token lifecycle management. It supports multiple standardized grant types (Client Credentials, Authorization Code, Refresh Token, JWT Bearer, Device Authorization, and others) and can work with any OAuth2.x/OIDC-compliant Authorization Server. The package handles token expiration tracking, refresh logic, and client authentication methods including Client Secret Post, Client Secret Basic, Client Secret JWT, and Private Key JWT.

The library provides two main entry points: BearerToken for using an already-obtained access token as a requests auth handler, and OAuth2Client for the full OAuth2 flow including token endpoint communication, token revocation, introspection, and PKCE support. It also wraps requests.Session to simplify REST API calls with or without OAuth2 authentication. The package is in Beta status, supports Python 3.9 through 3.14, and has no known vulnerabilities.

Use it for:

• Authenticate to third-party REST APIs that require OAuth2 bearer tokens without manually managing token refresh cycles
• Implement OAuth2 client flows (Authorization Code, Client Credentials) to obtain tokens from your own or third-party Authorization Servers
• Build applications that need to support OpenID Connect for user authentication and identity verification
• Manage token revocation and introspection for security-sensitive applications requiring explicit token lifecycle control
• Develop multi-grant OAuth2 clients that switch between different authentication methods based on deployment context

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

An OAuth 2.x client for Python that obtains, refreshes, and revokes tokens from any OAuth2.x/OIDC-compliant Authorization Server, built on top of the requests HTTP library.

Yes, with conditions. The package is actively maintained, has low install friction, and covers a comprehensive set of OAuth2 and OIDC standards. It is suitable for production use if your Authorization Server is standards-compliant. However, verify that the specific grant types and extensions you need are supported, and test token refresh behavior in your concurrency model before deploying to high-traffic services.

Install

requests-oauth2client on PyPI

pip install requests-oauth2client

uv add requests-oauth2client

poetry add requests-oauth2client

Installing requests-oauth2client

Before you install

Low install friction with a pure-wheel distribution. The package is actively maintained with a recent commit on 2026-08-11 and has been in active development since 2020-07-15. Five runtime dependencies (attrs, binapy, furl, jwskate, requests) are all well-established libraries.

License in practice

Licensed under Apache-2.0 (permissive), allowing commercial and private use with minimal restrictions. You must include a copy of the license and state significant changes, but there are no copyleft obligations.

Quickstart

pip install requests_oauth2client

from requests_oauth2client import OAuth2Client, BearerToken

oauth2client = OAuth2Client(
    token_endpoint="https://auth.example.com/token",
    client_id="my_client_id",
    client_secret="my_client_secret"
)

token = BearerToken("my_access_token")
import requests
resp = requests.get("https://api.example.com/endpoint", auth=token)

Verify before relying

• Whether binapy and jwskate are lightweight dependencies or introduce significant transitive bloat
• Performance characteristics when managing token refresh cycles in high-concurrency scenarios
• Coverage of less common OAuth2 grant types (CIBA, Device Authorization) in real-world Authorization Servers

Package facts

Evidence: requests_oauth2client-1.8.0-py3-none-any.whl

Tags

More Security packages