Just want one protected view? Start with the Flask quickstart.
authdog.flask caches session context on flask.g and exposes a require_auth decorator. Other Python frameworks: FastAPI, Django, Starlette, aiohttp. Hub: Python.
Availability and install
Unreleased on PyPI. Source-only in `packages/python`. Python 3.10+, Flask 3.0+, httpx 0.27+.
python -m pip install "./packages/python[flask]"Configure
import os
from flask import Flask
from authdog.flask import Authdog
app = Flask(__name__)
authdog = Authdog(public_key=os.environ["PK_AUTHDOG"])The public key is publishable. Construction rejects malformed keys and identity hosts outside the trusted HTTPS allowlist.
Session and gate
session() returns a typed context from any view and caches it on flask.g. Repeat calls in one request do not hit userinfo again. @require_auth is the 401 boundary.
Flask drives userinfo with asyncio.run on the sync view path.
@app.get("/")
def index():
return {"authenticated": authdog.session().is_authenticated}
@app.get("/me")
@authdog.require_auth
def me():
return authdog.session().user
@app.get("/logout")
def logout():
return authdog.logout()logout() (no request argument) returns a redirect Response that expires the cookie.
Works with blueprints as ordinary view decorators.
Shared rules
The resolver prefers authdog-session, then Authorization: Bearer <token>. fetch_user=False leaves is_authenticated false, so the decorator rejects. Apply authorization after the gate.
Self-hosted identity hosts need AUTHDOG_ALLOWED_IDENTITY_HOSTS.
Example
- Status board: runnable example for this stack.