Need help with python-oauth2?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

124 Stars 38 Forks MIT License 326 Commits 0 Opened issues


[UNMAINTAINED] OAuth 2.0 provider written in python

Services available


Need anything else?

Contributors list

No Data

This project is not maintained anymore. If you are looking for a OAuth 2.0 library to integrate into your Python application, I recommend



python-oauth2 is a framework that aims at making it easy to provide authentication via

OAuth 2.0 
_ within an application stack.



.. image:: :target:

python-oauth2 has reached its beta phase. All main parts of the

OAuth 2.0 RFC 
_ such as the various types of Grants, Refresh Token and Scopes have been implemented. However, bugs might occur or implementation details might be wrong.


python-oauth2 is available on

pip install python-oauth2


Example Authorization server

.. code-block:: python

from wsgiref.simple_server import make_server
import oauth2
import oauth2.grant
import oauth2.error
import oauth2.tokengenerator
import oauth2.web.wsgi

Create a SiteAdapter to interact with the user.

This can be used to display confirmation dialogs and the like.

class ExampleSiteAdapter(oauth2.web.AuthorizationCodeGrantSiteAdapter, oauth2.web.ImplicitGrantSiteAdapter): TEMPLATE = '''

        <a href="%7Burl%7D&amp;confirm=confirm">confirm</a>
        <a href="%7Burl%7D&amp;deny=deny">deny</a>


def authenticate(self, request, environ, scopes, client):
    # Check if the user has granted access
    if request.post_param("confirm") == "confirm":
        return {}

    raise oauth2.error.UserNotAuthenticated

def render_auth_page(self, request, response, environ, scopes,
    url = request.path + "?" + request.query_string
    response.body = self.TEMPLATE.format(url=url)
    return response

def user_has_denied_access(self, request):
    # Check if the user has denied access
    if request.post_param("deny") == "deny":
        return True
    return False

Create an in-memory storage to store your client apps.

client_store =

Add a client

client_store.add_client(client_id="abc", client_secret="xyz", redirect_uris=["http://localhost/callback"])

site_adapter = ExampleSiteAdapter()

Create an in-memory storage to store issued tokens.

LocalTokenStore can store access and auth tokens

token_store =

Create the controller.

provider = oauth2.Provider( access_token_store=token_store, auth_code_store=token_store, client_store=client_store, token_generator=oauth2.tokengenerator.Uuid4() )

Add Grants you want to support

provider.add_grant(oauth2.grant.AuthorizationCodeGrant(site_adapter=site_adapter)) provider.add_grant(oauth2.grant.ImplicitGrant(site_adapter=site_adapter))

Add refresh token capability and set expiration time of access tokens

to 30 days


Wrap the controller with the Wsgi adapter

app = oauth2.web.wsgi.Application(provider=provider)

if name == "main": httpd = make_server('', 8080, app) httpd.serve_forever()

This example only shows how to instantiate the server. It is not a working example as a client app is missing. Take a look at the

_ directory.

Supported storage backends

python-oauth2 does not force you to use a specific database. It currently supports these storage backends out-of-the-box:

  • MongoDB
  • MySQL
  • Redis
  • Memcached

However, you are not not bound to these implementations. By adhering to the interface defined by the base classes in
, you can easily add an implementation of your backend. It also is possible to mix different backends and e.g. read data of a client from MongoDB while saving all tokens in memcached for fast access.

Take a look at the examples in the examples directory of the project.

Site adapter

Like for storage, python-oauth2 does not define how you identify a user or show a confirmation dialogue. Instead your application should use the API defined by


We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.