Install & Compatibility
Where this runs
tested against v5.8.1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 1.252s · 33.4MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 4.1s · import 1.216s · 34MB
32MB installed
● package 32MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Security
✓ from flask_security import Security
✗ from flask_security import FlaskSecurity
Old class name was FlaskSecurity, now it's Security.
SQLAlchemyUserDatastore
✓ from flask_security import SQLAlchemyUserDatastore
UserMixin
✓ from flask_security import UserMixin
RoleMixin
✓ from flask_security import RoleMixin
login_required
✓ from flask_security import login_required
✗ from flask_security.decorators import login_required
login_required is exported at package level, direct import is preferred.
Minimal Flask-Security app with SQLAlchemy user store, showing setup of User/Role models, Security init, and a protected route.
from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_security import Security, SQLAlchemyUserDatastore, UserMixin, RoleMixin, login_required
app = Flask(__name__)
app.config['SECRET_KEY'] = 'super-secret'
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///:memory:'
app.config['SECURITY_PASSWORD_SALT'] = 'salty-salt'
db = SQLAlchemy(app)
class Role(db.Model, RoleMixin):
id = db.Column(db.Integer, primary_key=True)
name = db.Column(db.String(80), unique=True)
description = db.Column(db.String(255))
class User(db.Model, UserMixin):
id = db.Column(db.Integer, primary_key=True)
email = db.Column(db.String(255), unique=True)
password = db.Column(db.String(255))
active = db.Column(db.Boolean())
confirmed_at = db.Column(db.DateTime())
roles = db.relationship('Role', secondary='roles_users', backref=db.backref('users', lazy='dynamic'))
class RolesUsers(db.Model):
id = db.Column(db.Integer, primary_key=True)
user_id = db.Column(db.Integer, db.ForeignKey('user.id'))
role_id = db.Column(db.Integer, db.ForeignKey('role.id'))
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)
@app.route('/')
@login_required
def home():
return 'Hello, user!'
with app.app_context():
db.create_all()
if not User.query.filter_by(email='test@example.com').first():
user_datastore.create_user(email='test@example.com', password='password')
db.session.commit()
if __name__ == '__main__':
app.run()
Errors
Common errors & fixes
ImportError: cannot import name 'FlaskSecurity' from 'flask_security'
Flask-Security 5.x renamed the class from FlaskSecurity to Security.
fixChange import to 'from flask_security import Security'.
TypeError: 'NoneType' object is not subscriptable when accessing user.roles
Missing backref or roles_users table not defined correctly.
fixEnsure the secondary table for roles (e.g., 'roles_users') is defined as a SQLAlchemy model with proper foreign keys.
AttributeError: 'NoneType' object has no attribute 'get' when using login_required
Flask-Security's login_required decorator expects the current_user proxy to be available (via Flask-Login).
fixMake sure Flask-Login is installed and 'flask_security' is initialized after the app config is set.
Upgrade
Version history
5.8.1latest on PyPI · released May 21, 2026
Audit
Dependencies
No dependency data recorded yet.