Registry / auth-security / oauth2

oauth2

JSON →
library1.9.0.post1pypypi✓ verified 21d ago

The `oauth2` library provides a Python implementation for the OAuth 1.0a protocol. While it remains functional for applications requiring this older standard, OAuth 1.0a has largely been superseded by OAuth 2.0 for modern API integrations. The library's last significant development occurred around 2015, with minor updates up to 2022, and the current PyPI version is 1.9.0.post1.

pip install oauth2
INSTALL
IMPORT
SIG · OAUTH2
O
oauth2
auth-securitypythonv1.9.0.post1
Install
1.7s avg
Import
1087ms
Disk
18MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v1.9.0.post1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.95 runs
installs and imports cleanly · install 0.0s · import 0.720s · 20.3MB
glibc
py 3.103.95 runs
installs and imports cleanly · install 1.7s · import 0.584s · 21MB
18MB installed
● package 18MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

Consumer
from oauth2 import Consumer
from oauth2 import Consumer

Demonstrates how to initialize an OAuth 1.0a client with consumer and token credentials (assuming they are pre-obtained), then use it to make a signed GET request to a protected resource. This is typical for 2-legged OAuth or after the 3-legged flow has completed and access tokens are available. The example uses environment variables for sensitive credentials.

import oauth2 import os from urllib.parse import parse_qsl # Replace with your actual consumer and token keys/secrets (from environment or config) CONSUMER_KEY = os.environ.get('OAUTH2_CONSUMER_KEY', 'your_consumer_key') CONSUMER_SECRET = os.environ.get('OAUTH2_CONSUMER_SECRET', 'your_consumer_secret') TOKEN_KEY = os.environ.get('OAUTH2_TOKEN_KEY', 'your_token_key') TOKEN_SECRET = os.environ.get('OAUTH2_TOKEN_SECRET', 'your_token_secret') # The URL to make a signed request to REQUEST_URL = "http://example.com/api/resource" # --- Step 1: Initialize Consumer and Token --- # Create a Consumer object (application credentials) consumer = oauth2.Consumer(key=CONSUMER_KEY, secret=CONSUMER_SECRET) # Create a Token object (user credentials obtained previously via 3-legged flow) token = oauth2.Token(key=TOKEN_KEY, secret=TOKEN_SECRET) # --- Step 2: Create an OAuth2 Client --- # The client combines consumer and token to sign requests client = oauth2.Client(consumer, token) # --- Step 3: Make a signed request --- print(f"Making a signed GET request to: {REQUEST_URL}") try: resp, content = client.request(REQUEST_URL, "GET") print(f"\nHTTP Status: {resp.status}") print(f"Response Content (first 200 chars): {content.decode('utf-8')[:200]}...") if resp.status != 200: print(f"Error: {content.decode('utf-8')}") except Exception as e: print(f"An error occurred during the request: {e}") # --- Example: Initiating a 3-legged OAuth flow (getting a request token) --- # This part assumes a request token URL exists for demonstration. # request_token_url = "http://example.com/oauth/request_token" # print(f"\nAttempting to get a request token from: {request_token_url}") # try: # # For requesting a request token, usually only the consumer is needed initially # req_client = oauth2.Client(consumer) # resp_req, content_req = req_client.request(request_token_url, "GET") # if resp_req.status == 200: # request_token_data = dict(parse_qsl(content_req.decode('utf-8'))) # print(f"Successfully got Request Token: {request_token_data}") # else: # print(f"Failed to get Request Token: Status {resp_req.status}, Content: {content_req.decode('utf-8')}") # except Exception as e: # print(f"An error occurred getting request token: {e}")
Debug
Known issues
breakingThe OAuth 1.0a standard implemented by this library is largely deprecated for new application development. Most modern APIs have transitioned to OAuth 2.0 or other authentication methods.
fix
For new projects, strongly consider using APIs that support OAuth 2.0 and corresponding Python libraries (e.g., `requests-oauthlib`, `authlib`). Only use `oauth2` if you explicitly need to interact with a legacy OAuth 1.0a API.
affects: All versions
gotchaThe `oauth2` library has seen very limited maintenance since 2015, with minor updates up to 2022. This means it lacks new features, security updates for modern vulnerabilities, or active compatibility testing with newer Python versions and their dependencies.
fix
Exercise extreme caution when deploying in production, especially for applications with strict security requirements. Consider auditing the library's code or migrating away from OAuth 1.0a if possible.
affects: All versions
gotchaThe library relies on `httplib2`, an older HTTP client library. While functional, `httplib2` may lack modern features, performance optimizations, or security best practices found in contemporary HTTP clients like `requests`.
fix
Be aware of `httplib2`'s limitations. Swapping out the underlying HTTP client would require modifying the `oauth2` library's source code, which is generally not recommended.
affects: All versions
gotchaThe name `oauth2` is misleading as it implements OAuth 1.0a, not OAuth 2.0. This can cause confusion with other libraries that *do* implement OAuth 2.0 (e.g., `requests-oauthlib` which supports both, or `authlib` which primarily focuses on OAuth 2.0).
fix
Always verify which OAuth version your target API supports. If it's OAuth 2.0, this `oauth2` library is the wrong choice.
affects: All versions
Upgrade
Version history
1.9.0.post1latest on PyPI · released Sep 12, 2015
Audit
Dependencies
httplib2requiredRequired HTTP client for making signed requests.
Agent activity
20 hits · last 30 days
node
18
OpenAI (training)
1
Resources