Package: requests-auth
Authentication for RequestsProvides authentication classes to be used withrequestsauthentication parameter.Some of the supported authenticationAvailable authenticationOAuth2Authorization Code FlowOktaAuthorization Code Flow with PKCEOktaResource Owner Password Credentials flowClient Credentials FlowOktaImplicit FlowAzure AD (Access Token)Azure AD (ID token)Okta (Access Token)Okta (ID token)Managing token cacheAPI keyIn headerIn queryBasicNTLM (Windows)Multiple authentication at onceEndorsementsOAuth 2Most ofOAuth2flows are supported.If the one you are looking for is not yet supported, feel free toask for its implementation.Authorization Code flowAuthorization Code Grant is implemented followingrfc6749.Userequests_auth.OAuth2AuthorizationCodeto configure this kind of authentication.importrequestsfromrequests_authimportOAuth2AuthorizationCoderequests.get('https://www.example.com',auth=OAuth2AuthorizationCode('https://www.authorization.url','https://www.token.url'))ParametersNameDescriptionMandatoryDefault valueauthorization_urlOAuth 2 authorization URL.Mandatorytoken_urlOAuth 2 token URL.Mandatoryredirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 code will be started.Optional5000timeoutMaximum amount of seconds to wait for a code or a token to be received once requested.Optional60success_display_timeIn case a code is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received code is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}response_typeValue of the response_type query parameter if not already provided in authorization URL.Optionalcodetoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0code_field_nameField name containing the code.OptionalcodeusernameUser name in case basic authentication should be used to retrieve token.OptionalpasswordUser password in case basic authentication should be used to retrieve token.Optionalsessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as query parameter in the authorization URL and as body parameters in the token URL.Usual extra parameters are:NameDescriptionclient_idCorresponding to your Application ID (in Microsoft Azure app portal)client_secretIf client is not authenticated with the authorization servernonceRefer toOpenID ID Token specificationsfor more detailsCommon providersMost ofOAuth2Authorization Code Grant providers are supported.If the one you are looking for is not yet supported, feel free toask for its implementation.Okta (OAuth2 Authorization Code)Okta Authorization Code Grantproviding access tokens is supported.Userequests_auth.OktaAuthorizationCodeto configure this kind of authentication.importrequestsfromrequests_authimportOktaAuthorizationCodeokta=OktaAuthorizationCode(instance='testserver.okta-emea.com',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')requests.get('https://www.example.com',auth=okta)ParametersNameDescriptionMandatoryDefault valueinstanceOkta instance (like "testserver.okta-emea.com").Mandatoryclient_idOkta Application Identifier (formatted as an Universal Unique Identifier).Mandatoryresponse_typeValue of the response_type query parameter if not already provided in authorization URL.Optionaltokentoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0nonceRefer toOpenID ID Token specificationsfor more details.OptionalNewly generated Universal Unique Identifier.scopeScope parameter sent in query. Can also be a list of scopes.Optionalopenidauthorization_serverOkta authorization server.Optional'default'redirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 token will be started.Optional5000timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60success_display_timeIn case a token is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received token is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}sessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as query parameter in the authorization URL.Usual extra parameters are:NameDescriptionpromptnone to avoid prompting the user if a session is already opened.Authorization Code Flow with Proof Key for Code ExchangeProof Key for Code Exchange is implemented followingrfc7636.Userequests_auth.OAuth2AuthorizationCodePKCEto configure this kind of authentication.importrequestsfromrequests_authimportOAuth2AuthorizationCodePKCErequests.get('https://www.example.com',auth=OAuth2AuthorizationCodePKCE('https://www.authorization.url','https://www.token.url'))ParametersNameDescriptionMandatoryDefault valueauthorization_urlOAuth 2 authorization URL.Mandatorytoken_urlOAuth 2 token URL.Mandatoryredirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 code will be started.Optional5000timeoutMaximum amount of seconds to wait for a code or a token to be received once requested.Optional60success_display_timeIn case a code is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received code is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}response_typeValue of the response_type query parameter if not already provided in authorization URL.Optionalcodetoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0code_field_nameField name containing the code.Optionalcodesessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as query parameter in the authorization URL and as body parameters in the token URL.Usual extra parameters are:NameDescriptionclient_idCorresponding to your Application ID (in Microsoft Azure app portal)client_secretIf client is not authenticated with the authorization servernonceRefer toOpenID ID Token specificationsfor more detailsCommon providersMost ofOAuth2Proof Key for Code Exchange providers are supported.If the one you are looking for is not yet supported, feel free toask for its implementation.Okta (OAuth2 Proof Key for Code Exchange)Okta Proof Key for Code Exchangeproviding access tokens is supported.Userequests_auth.OktaAuthorizationCodePKCEto configure this kind of authentication.importrequestsfromrequests_authimportOktaAuthorizationCodePKCEokta=OktaAuthorizationCodePKCE(instance='testserver.okta-emea.com',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')requests.get('https://www.example.com',auth=okta)ParametersNameDescriptionMandatoryDefault valueinstanceOkta instance (like "testserver.okta-emea.com").Mandatoryclient_idOkta Application Identifier (formatted as an Universal Unique Identifier).Mandatoryresponse_typeValue of the response_type query parameter if not already provided in authorization URL.Optionalcodetoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0code_field_nameField name containing the code.OptionalcodenonceRefer toOpenID ID Token specificationsfor more details.OptionalNewly generated Universal Unique Identifier.scopeScope parameter sent in query. Can also be a list of scopes.Optionalopenidauthorization_serverOkta authorization server.Optional'default'redirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 token will be started.Optional5000timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60success_display_timeIn case a token is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received token is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}sessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as query parameter in the authorization URL and as body parameters in the token URL.Usual extra parameters are:NameDescriptionclient_secretIf client is not authenticated with the authorization servernonceRefer toOpenID ID Token specificationsfor more detailsResource Owner Password Credentials flowResource Owner Password Credentials Grant is implemented followingrfc6749.Userequests_auth.OAuth2ResourceOwnerPasswordCredentialsto configure this kind of authentication.importrequestsfromrequests_authimportOAuth2ResourceOwnerPasswordCredentialsrequests.get('https://www.example.com',auth=OAuth2ResourceOwnerPasswordCredentials('https://www.token.url','user name','user password'))ParametersNameDescriptionMandatoryDefault valuetoken_urlOAuth 2 token URL.MandatoryusernameResource owner user name.MandatorypasswordResource owner password.Mandatorysession_authClient authentication if the client type is confidential or the client was issued client credentials (or assigned other authentication requirements). Can be a tuple or any requests authentication class instance.OptionaltimeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}scopeScope parameter sent to token URL as body. Can also be a list of scopes.Optionaltoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0sessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as body parameter in the token URL.Common providersMost ofOAuth2Resource Owner Password Credentials providers are supported.If the one you are looking for is not yet supported, feel free toask for its implementation.Okta (OAuth2 Resource Owner Password Credentials)Okta Resource Owner Password Credentialsproviding access tokens is supported.Userequests_auth.OktaResourceOwnerPasswordCredentialsto configure this kind of authentication.importrequestsfromrequests_authimportOktaResourceOwnerPasswordCredentialsokta=OktaResourceOwnerPasswordCredentials(instance='testserver.okta-emea.com',username='user name',password='user password',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd',client_secret="0c5MB")requests.get('https://www.example.com',auth=okta)ParametersNameDescriptionMandatoryDefault valueinstanceOkta instance (like "testserver.okta-emea.com").MandatoryusernameResource owner user name.MandatorypasswordResource owner password.Mandatoryclient_idOkta Application Identifier (formatted as an Universal Unique Identifier).Mandatoryclient_secretResource owner password.MandatorytimeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}scopeScope parameter sent in query. Can also be a list of scopes.Optionalopenidtoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0sessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as body parameters in the token URL.Client Credentials flowClient Credentials Grant is implemented followingrfc6749.Userequests_auth.OAuth2ClientCredentialsto configure this kind of authentication.importrequestsfromrequests_authimportOAuth2ClientCredentialsrequests.get('https://www.example.com',auth=OAuth2ClientCredentials('https://www.token.url',client_id='id',client_secret='secret'))ParametersNameDescriptionMandatoryDefault valuetoken_urlOAuth 2 token URL.Mandatoryclient_idResource owner user name.Mandatoryclient_secretResource owner password.MandatorytimeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}scopeScope parameter sent to token URL as body. Can also be a list of scopes.Optionaltoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0sessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as body parameter in the token URL.Common providersMost ofOAuth2Client Credentials Grant providers are supported.If the one you are looking for is not yet supported, feel free toask for its implementation.Okta (OAuth2 Client Credentials)Okta Client Credentials Grantproviding access tokens is supported.Userequests_auth.OktaClientCredentialsto configure this kind of authentication.importrequestsfromrequests_authimportOktaClientCredentialsokta=OktaClientCredentials(instance='testserver.okta-emea.com',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd',client_secret="secret")requests.get('https://www.example.com',auth=okta)ParametersNameDescriptionMandatoryDefault valueinstanceOkta instance (like "testserver.okta-emea.com").Mandatoryclient_idOkta Application Identifier (formatted as an Universal Unique Identifier).Mandatoryclient_secretResource owner password.Mandatoryauthorization_serverOkta authorization server.Optional'default'timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}scopeScope parameter sent in query. Can also be a list of scopes.Optionalopenidtoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0sessionrequests.Sessioninstance that will be used to request the token. Use it to provide a custom proxying rule for instance.OptionalAny other parameter will be put as query parameter in the token URL.Implicit flowImplicit Grant is implemented followingrfc6749.Userequests_auth.OAuth2Implicitto configure this kind of authentication.importrequestsfromrequests_authimportOAuth2Implicitrequests.get('https://www.example.com',auth=OAuth2Implicit('https://www.authorization.url'))ParametersNameDescriptionMandatoryDefault valueauthorization_urlOAuth 2 authorization URL.Mandatoryresponse_typeValue of the response_type query parameter if not already provided in authorization URL.Optionaltokentoken_field_nameField name containing the token.Optionalid_token if response_type is id_token, otherwise access_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0redirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 token will be started.Optional5000timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60success_display_timeIn case a token is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received token is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}Any other parameter will be put as query parameter in the authorization URL.Usual extra parameters are:NameDescriptionclient_idCorresponding to your Application ID (in Microsoft Azure app portal)nonceRefer toOpenID ID Token specificationsfor more detailspromptnone to avoid prompting the user if a session is already opened.Common providersMost ofOAuth2Implicit Grant providers are supported.If the one you are looking for is not yet supported, feel free toask for its implementation.Microsoft - Azure Active Directory (OAuth2 Access Token)Microsoft identity platform access tokensare supported.Userequests_auth.AzureActiveDirectoryImplicitto configure this kind of authentication.importrequestsfromrequests_authimportAzureActiveDirectoryImplicitaad=AzureActiveDirectoryImplicit(tenant_id='45239d18-c68c-4c47-8bdd-ce71ea1d50cd',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')requests.get('https://www.example.com',auth=aad)You can retrieve Microsoft Azure Active Directory application information thanks to theapplication list on Azure portal.ParametersNameDescriptionMandatoryDefault valuetenant_idMicrosoft Tenant Identifier (formatted as an Universal Unique Identifier).Mandatoryclient_idMicrosoft Application Identifier (formatted as an Universal Unique Identifier).Mandatoryresponse_typeValue of the response_type query parameter if not already provided in authorization URL.Optionaltokentoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0nonceRefer toOpenID ID Token specificationsfor more detailsOptionalNewly generated Universal Unique Identifier.redirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 token will be started.Optional5000timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60success_display_timeIn case a token is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received token is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}Any other parameter will be put as query parameter in the authorization URL.Usual extra parameters are:NameDescriptionpromptnone to avoid prompting the user if a session is already opened.Microsoft - Azure Active Directory (OpenID Connect ID token)Microsoft identity platform ID tokensare supported.Userequests_auth.AzureActiveDirectoryImplicitIdTokento configure this kind of authentication.importrequestsfromrequests_authimportAzureActiveDirectoryImplicitIdTokenaad=AzureActiveDirectoryImplicitIdToken(tenant_id='45239d18-c68c-4c47-8bdd-ce71ea1d50cd',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')requests.get('https://www.example.com',auth=aad)You can retrieve Microsoft Azure Active Directory application information thanks to theapplication list on Azure portal.ParametersNameDescriptionMandatoryDefault valuetenant_idMicrosoft Tenant Identifier (formatted as an Universal Unique Identifier).Mandatoryclient_idMicrosoft Application Identifier (formatted as an Universal Unique Identifier).Mandatoryresponse_typeValue of the response_type query parameter if not already provided in authorization URL.Optionalid_tokentoken_field_nameField name containing the token.Optionalid_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0nonceRefer toOpenID ID Token specificationsfor more detailsOptionalNewly generated Universal Unique Identifier.redirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 token will be started.Optional5000timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60success_display_timeIn case a token is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received token is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}Any other parameter will be put as query parameter in the authorization URL.Usual extra parameters are:NameDescriptionpromptnone to avoid prompting the user if a session is already opened.Okta (OAuth2 Implicit Access Token)Okta Implicit Grantproviding access tokens is supported.Userequests_auth.OktaImplicitto configure this kind of authentication.importrequestsfromrequests_authimportOktaImplicitokta=OktaImplicit(instance='testserver.okta-emea.com',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')requests.get('https://www.example.com',auth=okta)ParametersNameDescriptionMandatoryDefault valueinstanceOkta instance (like "testserver.okta-emea.com").Mandatoryclient_idOkta Application Identifier (formatted as an Universal Unique Identifier).Mandatoryresponse_typeValue of the response_type query parameter if not already provided in authorization URL.Optionaltokentoken_field_nameField name containing the token.Optionalaccess_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0nonceRefer toOpenID ID Token specificationsfor more details.OptionalNewly generated Universal Unique Identifier.scopeScope parameter sent in query. Can also be a list of scopes.Optional['openid', 'profile', 'email']authorization_serverOkta authorization server.Optional'default'redirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 token will be started.Optional5000timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60success_display_timeIn case a token is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received token is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}Any other parameter will be put as query parameter in the authorization URL.Usual extra parameters are:NameDescriptionpromptnone to avoid prompting the user if a session is already opened.Okta (OpenID Connect Implicit ID token)Okta Implicit Grantproviding ID tokens is supported.Userequests_auth.OktaImplicitIdTokento configure this kind of authentication.importrequestsfromrequests_authimportOktaImplicitIdTokenokta=OktaImplicitIdToken(instance='testserver.okta-emea.com',client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd')requests.get('https://www.example.com',auth=okta)ParametersNameDescriptionMandatoryDefault valueinstanceOkta instance (like "testserver.okta-emea.com").Mandatoryclient_idOkta Application Identifier (formatted as an Universal Unique Identifier).Mandatoryresponse_typeValue of the response_type query parameter if not already provided in authorization URL.Optionalid_tokentoken_field_nameField name containing the token.Optionalid_tokenearly_expiryNumber of seconds before actual token expiry where token will be considered as expired. Used to ensure token will not expire between the time of retrieval and the time the request reaches the actual server. Set it to 0 to deactivate this feature and use the same token until actual expiry.Optional30.0nonceRefer toOpenID ID Token specificationsfor more details.OptionalNewly generated Universal Unique Identifier.scopeScope parameter sent in query. Can also be a list of scopes.Optional['openid', 'profile', 'email']authorization_serverOkta authorization server.Optional'default'redirect_uri_endpointCustom endpoint that will be used as redirect_uri the following way:http://localhost:<redirect_uri_port>/<redirect_uri_endpoint>.Optional''redirect_uri_portThe port on which the server listening for the OAuth 2 token will be started.Optional5000timeoutMaximum amount of seconds to wait for a token to be received once requested.Optional60success_display_timeIn case a token is successfully received, this is the maximum amount of milliseconds the success page will be displayed in your browser.Optional1failure_display_timeIn case received token is not valid, this is the maximum amount of milliseconds the failure page will be displayed in your browser.Optional5000header_nameName of the header field used to send token.OptionalAuthorizationheader_valueFormat used to send the token value. "{token}" must be present as it will be replaced by the actual token.OptionalBearer {token}Any other parameter will be put as query parameter in the authorization URL.Usual extra parameters are:NameDescriptionpromptnone to avoid prompting the user if a session is already opened.Managing token cacheTo avoid asking for a new token every new request, a token cache is used.Default cache is in memory but it is also possible to use a physical cache.You need to provide the location of your token cache file. It can be a full or relative path.If the file already exists it will be used, if the file do not exists it will be created.fromrequests_authimportOAuth2,JsonTokenFileCacheOAuth2.token_cache=JsonTokenFileCache('path/to/my_token_cache.json')API key in headerYou can send an API key inside the header of your request usingrequests_auth.HeaderApiKey.importrequestsfromrequests_authimportHeaderApiKeyrequests.get('https://www.example.com',auth=HeaderApiKey('my_api_key'))ParametersNameDescriptionMandatoryDefault valueapi_keyThe API key that will be sent.Mandatoryheader_nameName of the header field.Optional"X-API-Key"API key in queryYou can send an API key inside the query parameters of your request usingrequests_auth.QueryApiKey.importrequestsfromrequests_authimportQueryApiKeyrequests.get('https://www.example.com',auth=QueryApiKey('my_api_key'))ParametersNameDescriptionMandatoryDefault valueapi_keyThe API key that will be sent.Mandatoryquery_parameter_nameName of the query parameter.Optional"api_key"BasicYou can use basic authentication usingrequests_auth.Basic.The only advantage of using this class instead ofrequestsnative support of basic authentication, is to be able to use it inmultiple authentication.importrequestsfromrequests_authimportBasicrequests.get('https://www.example.com',auth=Basic('username','password'))ParametersNameDescriptionMandatoryDefault valueusernameUser name.MandatorypasswordUser password.MandatoryNTLMRequiresrequests-negotiate-sspimoduleorrequests_ntlmmoduledepending on provided parameters.You can use Windows authentication usingrequests_auth.NTLM.importrequestsfromrequests_authimportNTLMrequests.get('https://www.example.com',auth=NTLM())ParametersNameDescriptionMandatoryDefault valueusernameUser name.Mandatory ifrequests_negotiate_sspimodule is not installed. In such a caserequests_ntlmmodule is mandatory.passwordUser password.Mandatory ifrequests_negotiate_sspimodule is not installed. In such a caserequests_ntlmmodule is mandatory.Multiple authentication at onceYou can also use a combination of authentication using+or&as in the following sample:importrequestsfromrequests_authimportHeaderApiKey,OAuth2Implicitapi_key=HeaderApiKey('my_api_key')oauth2=OAuth2Implicit('https://www.example.com')requests.get('https://www.example.com',auth=api_key+oauth2)Available pytest fixturesTesting the code usingrequests_authauthentication classes can be achieved using providedpytestfixtures.token_cache_mockfromrequests_auth.testingimporttoken_cache_mock,token_mockdeftest_something(token_cache_mock):# perform code using authenticationpassUse this fixture to mock authentication success for any of the following classes:OAuth2AuthorizationCodePKCEOktaAuthorizationCodePKCEOAuth2ImplicitOktaImplicitOktaImplicitIdTokenAzureActiveDirectoryImplicitAzureActiveDirectoryImplicitIdTokenOAuth2AuthorizationCodeOktaAuthorizationCodeOAuth2ClientCredentialsOktaClientCredentialsOAuth2ResourceOwnerPasswordCredentials,By default, an access token with value2YotnFZFEjr1zCsicMWpAAis generated.You can however return your custom token by providing your owntoken_mockfixture as in the following sample:importpytestfromrequests_auth.testingimporttoken_cache_mock@pytest.fixturedeftoken_mock()->str:return"MyCustomTokenValue"deftest_something(token_cache_mock):# perform code using authenticationpassYou can even return a more complex token by using thecreate_tokenfunction.Note thatpyjwtis a required dependency in this case as it is used to generate the token returned by the authentication.importpytestfromrequests_auth.testingimporttoken_cache_mock,create_token@pytest.fixturedeftoken_mock()->str:expiry=None# TODO Compute your expiryreturncreate_token(expiry)deftest_something(token_cache_mock):# perform code using authenticationpassAdvanced testingtoken_cacheThispytestfixture will return the token cache and ensure it is reset at the end of the test case.fromrequests_auth.testingimporttoken_cachedeftest_something(token_cache):# perform code using authenticationpassbrowser_mockThispytestfixture will allow to mock the behavior of a web browser.With thispytestfixture you will be allowed to fine tune your authentication related failures handling.pyjwtis a required dependency if you usecreate_tokenhelper function.importdatetimefromrequests_auth.testingimportbrowser_mock,BrowserMock,create_tokendeftest_something(browser_mock:BrowserMock):token_expiry=datetime.datetime.utcnow()+datetime.timedelta(hours=1)token=create_token(token_expiry)tab=browser_mock.add_response(opened_url="http://url_opened_by_browser?state=1234",reply_url=f"http://localhost:5000#access_token={token}&state=1234",)# perform code using authenticationtab.assert_success("You are now authenticated on 1234 You may close this tab.")EndorsementsI love requests_auth. As a ~15 year pythonista, this library makes working with OAuth services a breeze. <333Randall Degges, Head of Evangelism,Okta