Skip to content

Authority

Authority logo

Comprehensive, framework-agnostic Python authentication library.

Authority is a batteries-included authentication and authorization library for Python. It provides JWT access tokens with refresh rotation, TOTP MFA with recovery codes, WebAuthn / passkey support, RBAC, API key management, password security with HIBP breach checking, an event bus, and pluggable storage — all independent of any web framework.

Use Authority standalone, or plug it into FastAPI, Flask, Django, or Starlette with first-party integration modules. Generic ASGI and WSGI middleware cover everything else (including Quart).

Get Started Read the API Reference Try the examples

Highlights

  • JWT authentication with short-lived access tokens, opaque refresh tokens, rotation, family tracking, and reuse detection
  • TOTP MFA with Fernet-encrypted secrets and single-use recovery codes
  • WebAuthn / passkeys registration and authentication
  • RBAC with granular permissions and role assignments
  • API keys with prefix-based lookup, scopes, and expiry
  • Password security: complexity rules, history enforcement, and HIBP breach checking via k-anonymity
  • Pluggable storage: sync and async SQLite backends included, or implement StorageInterface / AsyncStorageInterface
  • Event bus with 22 typed lifecycle events and sync/async handlers
  • Audit logging with an append-only, chain-hashed trail
  • Full async support through AsyncAuthManager + AsyncSQLiteStorage
Topic Page
First steps Getting Started
Install options Installation
Sync & async usage, MFA, RBAC, API keys Usage
Every option and environment variable Configuration
Full public API reference API Reference
Design and module map Architecture
Screenshots of the example apps Screenshots
Contributing, testing, CI Development
Production guidance Deployment
Common questions FAQ
Problems and fixes Troubleshooting
Runnable web apps for each framework Examples

Requirements

  • Python 3.10+
  • SQLite (included in the Python standard library)