Install & Compatibility
Where this runs
tested against v13.0.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 55.6MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 6.2s · import 0.000s · 57MB
61MB installed
● package 61MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
AuthTokenMiddleware
✓ from keystonemiddleware.auth_token import AuthTokenMiddleware
✗ from keystonemiddleware.auth_token import AuthTokenMiddleware
This quickstart demonstrates how to wrap a simple WSGI application with the `AuthToken` middleware. It uses environment variables for configuration to make it runnable without hardcoding credentials. For `AuthToken` to function, a running Keystone instance and optionally Memcached (for token caching) are required. The example shows how to access user and project IDs populated by the middleware from the WSGI `environ`.
import os
from wsgiref.simple_server import make_server
from keystonemiddleware.auth_token import AuthToken
def simple_app(environ, start_response):
"""Simplest possible WSGI application"""
status = '200 OK'
headers = [('Content-type', 'text/plain; charset=utf-8')]
start_response(status, headers)
# AuthToken populates these if a valid token is provided
user_id = environ.get('HTTP_X_USER_ID', 'Unknown User ID')
project_id = environ.get('HTTP_X_PROJECT_ID', 'Unknown Project ID')
return [f"Hello, user '{user_id}' from project '{project_id}' via keystonemiddleware!\n".encode('utf-8')]
# Configuration for AuthToken (simplified, typically from paste.ini or configuration files)
# IMPORTANT: Replace with your actual Keystone endpoint and user/project details.
# For production, avoid 'insecure=True' and set 'memcached_servers'.
auth_config = {
'auth_url': os.environ.get('OS_AUTH_URL', 'http://localhost:5000/v3'),
'username': os.environ.get('OS_USERNAME', 'admin'),
'password': os.environ.get('OS_PASSWORD', 'secret'),
'project_name': os.environ.get('OS_PROJECT_NAME', 'admin'),
'user_domain_name': os.environ.get('OS_USER_DOMAIN_NAME', 'Default'),
'project_domain_name': os.environ.get('OS_PROJECT_DOMAIN_NAME', 'Default'),
'memcached_servers': os.environ.get('MEMCACHED_SERVERS', '127.0.0.1:11211'), # Required for caching
'insecure': 'True' if os.environ.get('OS_INSECURE') else 'False', # Use only for testing/development
'delay_auth_decision': 'True' # Allows app to handle unauthenticated requests if needed
}
# Wrap the application with AuthToken middleware
application = AuthToken(simple_app, auth_config)
if __name__ == '__main__':
httpd = make_server('', 8000, application)
print("Serving on port 8000...")
print("Access with a valid X-Auth-Token header to see user info:")
print(" curl -H \"X-Auth-Token: <your-keystone-token>\" http://localhost:8000/")
print("Or with no token (if 'delay_auth_decision' is True):")
print(" curl http://localhost:8000/")
print("Ensure memcached is running if configured, e.g., 'sudo apt install memcached' and 'systemctl start memcached'.")
print("Configure environment variables like OS_AUTH_URL, OS_USERNAME, OS_PASSWORD, etc. for actual Keystone integration.")
httpd.serve_forever()
Upgrade
Version history
13.0.0latest on PyPI · released May 13, 2026
Audit
Dependencies
keystoneauth1requiredCore library for interacting with Keystone for authentication.
oslo.configrequiredCommon dependency for OpenStack projects, used for configuration management.