Install & Compatibility
Where this runs
tested against v5.7.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 0.120s · 18.2MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 1.8s · import 0.098s · 19MB
19MB installed
● package 19MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Admin
✓ from duo_client import Admin
✗ from duo_client.admin import AdminApi
Auth
✓ from duo_client import Auth
Accounts
✓ from duo_client import Accounts
This quickstart demonstrates how to initialize the AuthApi client and perform a basic service check. It emphasizes the importance of loading sensitive API credentials from environment variables for security. Ensure DUO_IKEY, DUO_SKEY, and DUO_HOST are set in your environment or replaced with actual values.
import os
from duo_client.auth import AuthApi
# It's crucial to load credentials from environment variables or a secure secret store.
# DO NOT hardcode IKEY, SKEY, or HOST in your application code.
IKEY = os.environ.get('DUO_IKEY', 'DIXXXXXXXXXXXXXXXXXX') # Replace with your actual Integration Key
SKEY = os.environ.get('DUO_SKEY', 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') # Replace with your actual Secret Key
HOST = os.environ.get('DUO_HOST', 'api-xxxxxxxx.duosecurity.com') # Replace with your actual API Hostname
if IKEY == 'DIXXXXXXXXXXXXXXXXXX' or SKEY == 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' or HOST == 'api-xxxxxxxx.duosecurity.com':
print("Warning: Please set DUO_IKEY, DUO_SKEY, and DUO_HOST environment variables or replace placeholder values.")
print("Skipping quickstart execution due to placeholder credentials.")
else:
try:
# Initialize the Auth API client
auth_api = AuthApi(
ikey=IKEY,
skey=SKEY,
host=HOST,
)
# Make a simple API call to check service status
response = auth_api.check()
print("Duo Auth API Check successful:")
print(response)
except Exception as e:
print(f"Error checking Duo Auth API: {e}")
Debug
Known issues
breakingVersion 5.0.0 dropped support for Python versions below 3.7. Attempting to use `duo-client` 5.0.0 or later on older Python environments will result in errors.fixUpgrade your Python environment to version 3.7 or higher. If unable to upgrade, you must use an older version of `duo-client` (e.g., <5.0.0), though this is not recommended due to lack of updates and potential security issues.
affects: >=5.0.0
breakingAs of version 5.2.0, the client enforces the documented API usage requiring the child account hostname when using Admin API in conjunction with the Accounts API in multi-account setups. While the client may attempt to look up the hostname if not provided, explicitly defining it is the correct and reliable approach.fixEnsure that when interacting with the Admin API for child accounts, the correct child account hostname is explicitly provided during client initialization or API calls.
affects: >=5.2.0
deprecatedVersion 5.6.0 removed deprecated mobile restore parameters from settings. Code attempting to use these parameters will fail.fixReview your code for usage of mobile restore parameters in settings-related API calls and remove or replace them with current, supported alternatives.
affects: >=5.6.0
breakingDuo Security will no longer trust the DigiCert G1 root certificate after April 15, 2026. This is an external CA bundle expiry that will affect *all* Duo integrations, potentially causing connection failures if the underlying client (duo-client) and operating system do not support and trust the replacement DigiCert G5 root and use modern TLS (1.2/1.3).fixEnsure `duo-client` is updated to a recent version (e.g., 5.0.0+ as it supports Python 3.7+, which has TLS 1.2/1.3 support). Additionally, ensure the operating system and client environment's CA certificates are up-to-date to trust the DigiCert G5 root.
affects: All versions, but more impactful for older Python/OS environments
gotchaDuo API Integration Keys (IKEYs), Secret Keys (SKEYs), and API Hostnames (HOSTs) are highly sensitive credentials. Hardcoding them directly into source code is a major security risk.fixAlways load API credentials from secure sources such as environment variables, a dedicated secret management service (e.g., AWS Secrets Manager, HashiCorp Vault), or a configuration file that is explicitly excluded from version control.
affects: All versions
Upgrade
Version history
5.7.0latest on PyPI · released Aug 20, 2026
Audit
Dependencies
No dependency data recorded yet.