Registry / http-networking / httpx-auth

httpx-auth

JSON →
library0.23.1pypypi✓ verified 35d ago

httpx-auth is a Python library that provides a collection of authentication classes designed for use with the HTTPX client library. It supports various authentication schemes, including OAuth2 (Authorization Code, PKCE, Client Credentials, Resource Owner Password Credentials, Implicit flows), Okta, Microsoft Entra ID (formerly Azure AD), and AWS Signature Version 4. While a 1.0.0 release is pending HTTPX's own 1.0.0, the library is considered stable and is actively maintained.

http-networkingauth-securityawsazure
Install & Compatibility
Where this runs
tested against v0.23.1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.920 runs
installs and imports cleanly · install 0.0s · import 0.304s · 22.3MB
glibc
py 3.103.920 runs
installs and imports cleanly · install 2.2s · import 0.282s · 23MB
20MB installed
● package 20MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

from httpx_auth import OAuth2AuthorizationCode
from httpx_auth import AWS4Auth
from httpx_auth import OktaAuthorizationCodePKCE
from httpx_auth import MicrosoftEntraID

This quickstart demonstrates how to use `OAuth2AuthorizationCode` with HTTPX. It sets up an authentication object with placeholder OAuth2 URLs and a client ID. When `client.get()` is called, `httpx-auth` will manage the OAuth2 Authorization Code flow, typically by opening a browser for user interaction to obtain an access token, which is then used for the request. Remember to replace placeholder URLs and client ID with your actual values and configure the `redirect_uri` for your OAuth2 application if running locally.

import httpx import os from httpx_auth import OAuth2AuthorizationCode # In a real application, these would come from environment variables or a secure configuration # For this example, we use placeholders. Replace with your actual OAuth2 application details. CLIENT_ID = os.environ.get("OAUTH_CLIENT_ID", "your_client_id") AUTHORIZATION_URL = os.environ.get("OAUTH_AUTH_URL", "https://example.com/oauth/authorize") TOKEN_URL = os.environ.get("OAUTH_TOKEN_URL", "https://example.com/oauth/token") try: auth = OAuth2AuthorizationCode( client_id=CLIENT_ID, authorization_url=AUTHORIZATION_URL, token_url=TOKEN_URL, # For local development, redirect_uri would typically be a local callback URL. # httpx-auth will start a local server to capture the redirect. # Ensure this matches what's configured for your OAuth2 client application. # Example: redirect_uri="http://localhost:8000/callback", port=8000 ) with httpx.Client() as client: # The first request will trigger the OAuth2 flow: # 1. Opens a browser for user consent. # 2. User grants permission, browser redirects to redirect_uri. # 3. httpx-auth captures the code and exchanges it for a token. # 4. The request to the protected resource is then made with the acquired token. response = client.get("https://api.example.com/protected-resource", auth=auth) response.raise_for_status() print(f"Successfully authenticated and fetched data: {response.json()}") except httpx.HTTPStatusError as e: print(f"HTTP error occurred: {e.response.status_code} - {e.response.text}") except httpx.RequestError as e: print(f"An error occurred while making the request: {e}") except Exception as e: print(f"An unexpected error occurred: {e}")
Debug
Known footguns
breakingWhen providing an `httpx.Client` instance as a parameter to any `httpx-auth` OAuth2 authentication class (e.g., `client` parameter in `OAuth2AuthorizationCode`), `httpx-auth` no longer closes this client automatically. Users are now responsible for explicitly closing these client instances when they are no longer needed to prevent resource leaks.
gotchaThe `AWS4Auth` class, ported from `requests-aws4auth`, has specific behavioral changes and deprecated attributes compared to its origin. Notably, the `amz_date` attribute has been removed, direct provision of `AWSSigningKey` instances is not supported (use explicit parameters instead), and the `date` parameter now defaults to `now()` without options to override or raise on invalid date.
Upgrade
Version history

Breaking-change detection hasn't run for this library yet.

Audit
Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity
15 hits · last 30 days
gptbot
4
ahrefsbot
4
dotbot
2
script
1
Resources