|
| 1 | +The `auth0-api-python` library allows you to secure APIs running on Python, particularly for verifying Auth0-issued access tokens. |
| 2 | + |
| 3 | +It’s intended as a foundation for building more framework-specific integrations (e.g., with FastAPI, Django, etc.), but you can also use it directly in any Python server-side environment. |
| 4 | + |
| 5 | +  [](https://opensource.org/licenses/MIT) |
| 6 | + |
| 7 | +📚 [Documentation](#documentation) - 🚀 [Getting Started](#getting-started) - 💬 [Feedback](#feedback) |
| 8 | + |
| 9 | +## Documentation |
| 10 | + |
| 11 | +- [Docs Site](https://auth0.com/docs) - explore our docs site and learn more about Auth0. |
| 12 | + |
| 13 | +## Getting Started |
| 14 | + |
| 15 | +### 1. Install the SDK |
| 16 | + |
| 17 | +_This library requires Python 3.9+._ |
| 18 | + |
| 19 | +```shell |
| 20 | +pip install auth0-api-python |
| 21 | +``` |
| 22 | + |
| 23 | +If you’re using Poetry: |
| 24 | + |
| 25 | +```shell |
| 26 | +poetry install auth0-api-python |
| 27 | +``` |
| 28 | + |
| 29 | +### 2. Create the Auth0 SDK client |
| 30 | + |
| 31 | +Create an instance of the `ApiClient`. This instance will be imported and used anywhere we need access to the methods. |
| 32 | + |
| 33 | +```python |
| 34 | +from auth0_api_python import ApiClient, ApiClientOptions |
| 35 | + |
| 36 | + |
| 37 | +api_client = ApiClient(ApiClientOptions( |
| 38 | + domain="<AUTH0_DOMAIN>", |
| 39 | + audience="<AUTH0_AUDIENCE>" |
| 40 | +)) |
| 41 | +``` |
| 42 | + |
| 43 | +- The `AUTH0_DOMAIN` can be obtained from the [Auth0 Dashboard](https://manage.auth0.com) once you've created an application. |
| 44 | +- The `AUTH0_AUDIENCE` is the identifier of the API. You can find this in the [APIs section of the Auth0 Dashboard](https://manage.auth0.com/#/apis/). |
| 45 | + |
| 46 | +### 3. Verify the Access Token |
| 47 | + |
| 48 | +Use the `verify_access_token` method to validate access tokens. The method automatically checks critical claims like `iss`, `aud`, `exp`, `nbf`. |
| 49 | + |
| 50 | +```python |
| 51 | +import asyncio |
| 52 | + |
| 53 | +from auth0_api_python import ApiClient, ApiClientOptions |
| 54 | + |
| 55 | +async def main(): |
| 56 | + api_client = ApiClient(ApiClientOptions( |
| 57 | + domain="<AUTH0_DOMAIN>", |
| 58 | + audience="<AUTH0_AUDIENCE>" |
| 59 | + )) |
| 60 | + access_token = "..." |
| 61 | + |
| 62 | + decoded_and_verified_token = await api_client.verify_access_token(access_token=access_token) |
| 63 | + print(decoded_and_verified_token) |
| 64 | + |
| 65 | +asyncio.run(main()) |
| 66 | +``` |
| 67 | + |
| 68 | +In this example, the returned dictionary contains the decoded claims (like `sub`, `scope`, etc.) from the verified token. |
| 69 | + |
| 70 | +#### Requiring Additional Claims |
| 71 | + |
| 72 | +If your application demands extra claims, specify them with `required_claims`: |
| 73 | + |
| 74 | +```python |
| 75 | +decoded_and_verified_token = await api_client.verify_access_token( |
| 76 | + access_token=access_token, |
| 77 | + required_claims=["my_custom_claim"] |
| 78 | +) |
| 79 | +``` |
| 80 | + |
| 81 | +If the token lacks `my_custom_claim` or fails any standard check (issuer mismatch, expired token, invalid signature), the method raises a `VerifyAccessTokenError`. |
| 82 | + |
| 83 | +## Feedback |
| 84 | + |
| 85 | +### Contributing |
| 86 | + |
| 87 | +We appreciate feedback and contribution to this repo! Before you get started, please read the following: |
| 88 | + |
| 89 | +- [Auth0's general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md) |
| 90 | +- [Auth0's code of conduct guidelines](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md) |
| 91 | +- [This repo's contribution guide](./../../CONTRIBUTING.md) |
| 92 | + |
| 93 | +### Raise an issue |
| 94 | + |
| 95 | +To provide feedback or report a bug, please [raise an issue on our issue tracker](https://github.com/auth0/auth0-server-python/issues). |
| 96 | + |
| 97 | +## Vulnerability Reporting |
| 98 | + |
| 99 | +Please do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy) details the procedure for disclosing security issues. |
| 100 | + |
| 101 | +## What is Auth0? |
| 102 | + |
| 103 | +<p align="center"> |
| 104 | + <picture> |
| 105 | + <source media="(prefers-color-scheme: dark)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_dark_mode.png" width="150"> |
| 106 | + <source media="(prefers-color-scheme: light)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150"> |
| 107 | + <img alt="Auth0 Logo" src="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150"> |
| 108 | + </picture> |
| 109 | +</p> |
| 110 | +<p align="center"> |
| 111 | + Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout <a href="https://auth0.com/why-auth0">Why Auth0?</a> |
| 112 | +</p> |
| 113 | +<p align="center"> |
| 114 | + This project is licensed under the MIT license. See the <a href="https://github.com/auth0/auth0-server-python/blob/main/packages/auth0_api_python/LICENSE"> LICENSE</a> file for more info. |
| 115 | +</p> |
0 commit comments