OAuthLib

OAuthLib is a generic, thoroughly spec-compliant implementation of the OAuth request-signing and token logic for Python, covering both OAuth1 and OAuth2, plus OpenID Connect. It deliberately does not bundle any HTTP client, web framework, or transport layer — it implements the pure signing/validation/grant logic defined by the RFCs and leaves integration with requests, Flask, Django, or any other stack to thin adapter packages (requests-oauthlib, django-oauth-toolkit, flask-oauthlib, and others) built on top of it.

Because it is protocol logic rather than a full framework, OAuthLib underpins a large share of the Python OAuth ecosystem: it supplies OAuth1/OAuth2 client and provider primitives (authorization grants, token generation/validation, signature methods), an OpenID Connect layer, and RSA/HMAC/PLAINTEXT signing methods, all designed to be embedded inside whatever web framework or HTTP client a project already uses.

What You Get

• Full OAuth1 client and provider primitives, including HMAC-SHA1, RSA-SHA1, and PLAINTEXT signature methods
• OAuth2 grant types (authorization code, implicit, client credentials, refresh token, etc.) for both client and provider roles
• An OpenID Connect layer built on top of the OAuth2 provider primitives
• RSA and JWT-based signed token support via optional cryptography/pyjwt extras
• Framework-agnostic design consumed by adapter packages like requests-oauthlib, django-oauth-toolkit, and flask-oauthlib

Common Use Cases

• Implementing an OAuth2 authorization server or resource server in a custom Python web framework
• Building an OAuth1/OAuth2 API client that needs correct request signing without adopting a full SDK
• Adding OpenID Connect login/token issuance to an existing Python auth stack
• Powering higher-level integration packages (requests-oauthlib, django-oauth-toolkit) that need spec-correct OAuth internals

Under The Hood

Architecture - The package is split into oauthlib/oauth1/ and oauthlib/oauth2/ for the two protocol generations, with oauthlib/openid/ layered on top of the OAuth2 provider machinery for OIDC. Each protocol module separates rfc5849/rfc6749-style request validation from signature generation, and grant-type logic (authorization code, implicit, client credentials, refresh token) is implemented as discrete classes so a consuming framework wires up only the flows it needs. uri_validate.py and common.py hold shared RFC-3986 URI parsing and normalization logic used across both protocol implementations.

Tech Stack - Pure Python 3.8+ with no required third-party runtime dependency; RSA and signed-JWT support are optional extras pulling in cryptography and pyjwt, and an optional blinker-based signals extra allows hooking into internal events. Tested via tox/pytest across supported Python versions, linted with ruff, and packaged with classic setup.py/setup.cfg.

Code Quality - The tests/ directory contains 77 test files mirroring the oauth1/oauth2/openid module structure, with continuous coverage tracking via Coveralls and CI enforced through GitHub Actions. As a security-critical library (implementing cryptographic request signing), the codebase follows the relevant RFCs closely and documents a SECURITY.md disclosure process, reflecting the scrutiny expected of auth infrastructure.

API Design - Because OAuthLib is intentionally framework-agnostic, using it directly requires implementing a RequestValidator subclass to bridge the library’s abstract validation hooks to your storage/user model — this is more setup than a batteries-included SDK, but it’s the tradeoff for being embeddable in any Python web stack; most consumers instead reach for a thin per-framework wrapper package that pre-wires this for them.