Metadata-Version: 2.4
Name: litestar-security
Version: 0.1.0
Summary: Authentication and authorization for Litestar applications
Project-URL: Documentation, https://cofin.github.io/litestar-security/
Project-URL: Issues, https://github.com/cofin/litestar-security/issues
Project-URL: Source, https://github.com/cofin/litestar-security
Author-email: Cody Fincher <cody@litestar.dev>
License: MIT
License-File: LICENSE
Keywords: api-keys,authentication,authorization,litestar,oauth2,oidc,passkeys,security,webauthn,websockets
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Web Environment
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Natural Language :: English
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: argon2-cffi<26,>=25.1
Requires-Dist: httpx>=0.28.1
Requires-Dist: litestar>=2.24.0
Requires-Dist: pyjwt[crypto]>=2.13
Requires-Dist: pyotp<3,>=2.10
Requires-Dist: webauthn<4,>=3
Description-Content-Type: text/markdown

# Litestar Security

Authentication and authorization for [Litestar](https://litestar.dev/)
applications.

Litestar Security connects authentication providers to Litestar's middleware,
dependency injection, guards, OpenAPI schema, and WebSocket lifecycle. Use
local sessions or tokens, OAuth and OIDC, Google IAP, API keys, or workload
JWTs without tying your application to a database library.

## Quickstart

Install the package:

```console
pip install litestar-security
```

Create `app.py`:

```python
from litestar import Litestar, get
from litestar.di import NamedDependency

from litestar_security import (
    SecurityConfig,
    SecurityContext,
    SecurityPlugin,
    public,
)


@get("/", auth=public(), sync_to_thread=False)
def index(security_context: NamedDependency[SecurityContext]) -> dict[str, bool]:
    return {"authenticated": bool(security_context.evidence)}


app = Litestar(route_handlers=[index], plugins=[SecurityPlugin(SecurityConfig())])
```

Run the application:

```console
litestar --app app:app run
```

Public routes must be explicit. Once an authentication provider and
authorization resolver are configured, routes are protected by default and
guards can enforce application permissions:

```python
from litestar import get

from litestar_security import required, requires_team_role


@get(
    "/teams/{team_id:str}",
    auth=required(),
    guards=[requires_team_role(team_parameter="team_id", roles={"owner"})],
)
async def team_settings(team_id: str) -> dict[str, str]:
    return {"team_id": team_id}
```

## Next steps

- [Read the documentation](https://cofin.github.io/litestar-security/)
- [Choose an authentication provider](https://cofin.github.io/litestar-security/providers.html)
- [Configure local accounts](https://cofin.github.io/litestar-security/getting-started.html)
- [Run the API, team, and local-auth examples](examples/README.md)
- [Browse the API reference](https://cofin.github.io/litestar-security/reference.html)

Litestar Security supports Python 3.10 through 3.14 and is licensed under MIT.
