Metadata-Version: 2.5
Name: masks-client
Version: 0.3.2
Summary: Sign a Python service or machine in to masks, hold its tokens to a key with DPoP, and check masks access tokens in an API.
Project-URL: Homepage, https://masks.pages.dev
Project-URL: Source, https://github.com/masksrb/masks/tree/main/python
Project-URL: Changelog, https://github.com/masksrb/masks/blob/main/python/CHANGELOG.md
Author-email: Jon Geiger <jon@geiger.to>
License-Expression: MIT
License-File: LICENSE
Keywords: authentication,dpop,masks,oauth,openid-connect
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: anyio>=4.5
Requires-Dist: cryptography>=44
Requires-Dist: httpx<1,>=0.28.1
Requires-Dist: pyjwt>=2.10
Provides-Extra: django
Requires-Dist: django>=5.2; extra == 'django'
Provides-Extra: fastapi
Requires-Dist: fastapi>=0.115; extra == 'fastapi'
Provides-Extra: flask
Requires-Dist: flask>=3.1; extra == 'flask'
Description-Content-Type: text/markdown

# masks for Python

`masks-client` connects a Python web app, service, or machine to a
[masks](https://masks.pages.dev) server. It signs people in to FastAPI, Django,
and Flask apps, gets tokens for a service or machine, and checks access tokens
in an API.

## Install

It needs Python 3.10 or later and imports as `masks`.

```sh
pip install masks-client
```

A web app adds the extra for its framework: `masks-client[fastapi]`,
`masks-client[django]`, or `masks-client[flask]`.

## Sign people in to a FastAPI app

```python
import os
from typing import Annotated

from fastapi import Depends, FastAPI
from masks.fastapi import Actor, Config, Masks

auth = Masks(
    Config(
        issuer=os.environ["MASKS_ISSUER"],
        resource="https://app.example.com",
        name="Catalog",
        secret=os.environ["SESSION_SECRET"],
    )
)

app = FastAPI()
auth.install(app)


@app.get("/settings")
async def settings(actor: Annotated[Actor, Depends(auth.require())]):
    return {"name": actor.name}
```

To connect the app to masks:

1. Set `MASKS_ISSUER` to your masks tenant.
2. Start the app.
3. Open `/auth/handshake` and approve the app in masks.

## Documentation

- [Python apps](https://masks.pages.dev/reference/python/) explains the
  handshake, sessions, privileges, and checking tokens.
- [FastAPI](https://masks.pages.dev/reference/python/fastapi/),
  [Django](https://masks.pages.dev/reference/python/django/), and
  [Flask](https://masks.pages.dev/reference/python/flask/) set up each framework.
- [masks-client](https://masks.pages.dev/reference/python/client/) lists every
  setting and call, including machines, DPoP, and the device flow.
