Package: authlete
Authlete Library for PythonOverviewThis is the official Python library forAuthleteWeb APIs.LicenseApache License, Version 2.0Source Codehttps://github.com/authlete/authlete-pythonPyPI (Python Package Index)https://pypi.org/project/authlete/Installpip install authleteQuick StartThe following code simulates "Authorization Code Flow". ReplaceCLIENT_ID,SERVICE_API_KEYandSERVICE_API_SECRETin the code with your own properly.
The code assumes that the client type of the client application is 'public'
(otherwise client authentication would be required at the token endpoint) and
the number of registered redirect URIs is one (otherwiseredirect_urirequest
parameter would be required).fromauthlete.apiimport*fromauthlete.confimport*fromauthlete.dtoimport*#--------------------------------------------------# Your Configuration#--------------------------------------------------authlete_api_server='https://api.authlete.com'service_api_key='SERVICE_API_KEY'service_api_secret='SERVICE_API_SECRET'client_id='CLIENT_ID'user_id='USER_ID'# If the Authlete version is 3.0 or higherservice_access_token='SERVICE_ACCESS_TOKEN'service_api_secret=None#--------------------------------------------------# AuthleteApi#--------------------------------------------------# Configuration to access Authlete APIs.cnf=AuthleteConfiguration()cnf.baseUrl=authlete_api_servercnf.serviceApiKey=service_api_keycnf.serviceApiSecret=service_api_secret# If the Authlete version is 3.0 or highercnf.apiVersion="V3"cnf.serviceAccessToken=service_access_tokencnf.serviceApiSecret=None# Authlete API callerapi=AuthleteApiImpl(cnf)#--------------------------------------------------# /api/auth/authorization API#--------------------------------------------------# Prepare a request to /api/auth/authorization API.req=AuthorizationRequest()req.parameters='response_type=code&client_id={}'.format(client_id)# Call /api/auth/authorization API. The class of the# response is authlete.dto.AuthorizationResponse.res=api.authorization(req)#--------------------------------------------------# /api/auth/authorization/issue API#--------------------------------------------------# Prepare a request to /api/auth/authorization/issue API.req=AuthorizationIssueRequest()req.ticket=res.ticketreq.subject=user_id# Call /api/auth/authorization/issue API. The class of the# response is authlete.dto.AuthorizationIssueResponse.res=api.authorizationIssue(req)# An authorization response returned to the user agent.print('HTTP/1.1 302 Found')print('Location:{}'.format(res.responseContent))#--------------------------------------------------# /api/auth/token API#--------------------------------------------------# Prepare a request to /api/auth/token API.req=TokenRequest()req.parameters='client_id={}&grant_type=authorization_code&code={}'\.format(client_id,res.authorizationCode)# Call /api/auth/token API. The class of the response is# authlete.dto.TokenResponse.res=api.token(req)# A token response returned to the client.print("\nHTTP/1.1 200 OK")print("Content-Type: application/json\n")print(res.responseContent)DescriptionHow To Get AuthleteApiAll the methods to communicate with Authlete Web APIs are gathered inauthlete.api.AuthleteApiinterface.authlete.api.AuthleteApiImplclass is
the only implementation of the interface. The constructor ofAuthleteApiImplclass requires an instance ofauthlete.conf.AuthleteConfigurationclass.# Prepare an instance of AuthleteConfiguration.cnf=AuthleteConfiguration()cnf.baseUrl=...cnf.serviceOwnerApiKey=...cnf.serviceOwnerApiSecret=...cnf.serviceApiKey=...cnf.serviceApiSecret=...# If the Authlete version is 3.0 or highercnf.apiVersion="V3"cnf.serviceAccessToken=...cnf.serviceApiSecret=None# Get an implementation of AuthleteApi interface.api=AuthleteApiImpl(cnf)AuthleteConfigurationclass has two subclasses,AuthleteEnvConfigurationandAuthleteIniConfiguration.AuthleteEnvConfigurationclass reads settings from the following environment
variables.AUTHLETE_API_VERSIONAUTHLETE_BASE_URLAUTHLETE_SERVICEOWNER_APIKEYAUTHLETE_SERVICEOWNER_APISECRETAUTHLETE_SERVICE_APIKEYAUTHLETE_SERVICE_APISECRETAUTHLETE_SERVICE_ACCESSTOKENThe constructor ofAuthleteEnvConfigurationreads the environment variables,
so what you have to do in Python code is just to create an instance of the
class as follows.cnf=AuthleteEnvConfiguration()On the other hand,AuthleteIniConfigurationclass reads an INI file. The
format of the fileAuthleteIniConfigurationexpects is as follows.[authlete]api_version=...base_url=...service_owner.api_key=...service_owner.api_secret=...service.api_key=...service.api_secret=...service.access_token=...The constructor ofAuthleteIniConfigurationaccepts an optional parameter
which represents the name of an INI file. If the parameter is omitted,authlete.iniis used as the default file. If the name of your INI file is
notauthlete.ini, pass the file name to the constructor explicitly as follows.cnf=AuthleteIniConfiguration('configuration.ini')AuthleteApi SettingsgetSettings()method ofAuthleteApiinterface returns an instance ofauthlete.api.Settingsclass. You can set connection timeout and read timeout
via the instance.settings=api.getSettings()settings.connectionTimeout=5.0settings.readTimeout=5.0AuthleteApi Method CategoriesMethods inAuthleteApiinterface can be divided into some categories.Methods for Authorization Endpoint Implementationauthorization(request)authorizationFail(equest)authorizationIssue(request)Methods for Token Endpoint Implementationtoken(request)tokenFail(request)tokenIssue(request)idTokenReissue(request)Methods for Service ManagementcreateService(service)deleteService(serviceApiKey)getService(serviceApiKey)getServiceList(start=None, end=None)updateService(service)Methods for Client Application ManagementcreateClient(client)deleteClient(clientId)getClient(clientId)getClientList(developer=None, start=None, end=None)updateClient(client)refreshClientSecret(clientId)updateClientSecret(clientId, clientSecret)Methods for Access Token Introspectionintrospection(request)standardIntrospection(request)getTokenList(clientIdentifier=None, subject=None, start=None, end=None)Methods for Revocation Endpoint Implementationrevocation(request)Methods for User Info Endpoint Implementationuserinfo(request)userinfoIssue(request)Methods for JWK Set Endpoint ImplementationgetServiceJwks(pretty=True, includePrivateKeys=False)Methods for OpenID Connect DiscoverygetServiceConfiguration(request=None)Methods for Token OperationstokenCreate(request)tokenDelete(token)tokenRevoke(request)tokenUpdate(request)Methods for Requestable Scopes per Client (deprecated; Client APIs suffice)getRequestableScopes(clientId)setRequestableScopes(clientId, scopes)deleteRequestableScopes(clientId)Methods for Records of Granted ScopesgetGrantedScopes(clientId, subject)deleteGrantedScopes(clientId, subject)Methods for Authorization Management on a User-Client Combination BasisdeleteClientAuthorization(clientId, subject)getClientAuthorizationList(request)updateClientAuthorization(clientId, request)Methods for JOSEverifyJose(request)Methods for CIBA (Client Initiated Backchannel Authentication)backchannelAuthentication(request)backchannelAuthenticationIssue(request)backchannelAuthenticationFail(request)backchannelAuthenticationComplete(request)Methods for OpenID Connect Dynamic Client RegistrationdynamicClientRegister(request)dynamicClientGet(request)dynamicClientUpdate(request)dynamicClientDelete(request)Methods for Device FlowdeviceAuthorization(request)deviceComplete(request)deviceVerification(request)Methods for PAR (Pushed Authorization Request)pushAuthorizationRequest(request)Methods for Grant Management for OAuth 2.0gm(request)Methods for OpenID Federation 1.0federationConfiguration(request)federationRegistration(request)Methods for Verifiable CredentialscredentialIssuerMetadata(request)credentialIssuerJwks(request)credentialJwtIssuerMetadata(request)credentialOfferCreate(request)credentialOfferInfo(request)credentialSingleParse(request)credentialSingleIssue(request)credentialBatchParse(request)credentialBatchIssue(request)credentialDeferredParse(request)credentialDeferredIssue(request)Authlete VersionSome APIs and features don't work (even if they are defined in theAuthleteApiinterface) if Authlete API server you use doesn't support them. For example,
CIBA works only in Authlete 2.1 onwards. Please contact us if you want to use
newer Authlete versions.Features available in Authlete 2.0 and onwards:Financial-grade API (FAPI)OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens (MTLS)JWT-based Client Authentication (RFC 7523)Scope attributesUK Open Banking Security ProfileFeatures available in Authlete 2.1 and onwards:Client Initiated Backchannel Authentication (CIBA)JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)Dynamic Client Registration (RFC 7591 & RFC 7592)OAuth 2.0 Device Authorization Grant (Device Flow)JWT-based Access TokenSeeSpec Sheetfor further details.AWS SupportThis library contains a utility class to help implement aLambda Authorizerthat can protect APIs built onAmazon API Gatewaywith "certificate-bound access tokens" that conform toRFC 8705(OAuth 2.0 Mutual-TLS
Client Authentication and Certificate-Bound Access Tokens).Below is a short but completely working example of Lambda authorizer implementation
that is written using the utility class.fromauthlete.aws.apigateway.authorizerimportAuthorizerauthorizer=Authorizer()deflambda_handler(event,context):returnauthorizer.handle(event,context)See "Financial-grade Amazon API Gateway" for details.See Alsoauthlete-python-django: Authlete library for Djangodjango-oauth-server: Authorization server implementation using Djangodjango-resource-server: Resource server implementation using DjangoContactContact Form :https://www.authlete.com/contact/PurposeEmail AddressGeneralinfo@authlete.comSalessales@authlete.comPRpr@authlete.comTechnicalsupport@authlete.com