Learn how to integrate Auth0 with Python.

You can install the auth0 Python SDK using the following command.

pip install auth0-python

For python3, use the following command

pip3 install auth0-python

Python 3.2 and 3.3 have reached EOL and support will be removed in the near future.

The Authentication SDK is organized into components that mirror the structure of the API documentation. For example:

from auth0.v3.authentication import Social

social = Social('myaccount.auth0.com')

social.login(client_id='...', access_token='...', connection='facebook')

If you need to sign up a user using their email and password, you can use the Database object.

from auth0.v3.authentication import Database

database = Database('myaccount.auth0.com'')

database.signup(client_id='...', email='[email protected]', password='secr3t', connection='Username-Password-Authentication')

If you need to authenticate a user using their email and password, you can use the GetToken object, which enables making requests to the /oauth/token endpoint.

from auth0.v3.authentication import GetToken

token = GetToken('myaccount.auth0.com')

token.login(client_id='...', client_secret='...', username='[email protected]', password='secr3t', realm='Username-Password-Authentication')

Upon successful authentication, the credentials received may include an id_token, if the authentication request contained the openid scope. The id_token contains information associated with the authenticated user. You can read more about ID tokens here.

Before you access its contents, you must verify that the ID token has not been tampered with and that it is meant for your application to consume. The TokenVerifier class can be used to perform this verification.

To create a TokenVerifier, the following arguments are required:

• A SignatureVerifier instance, which is responsible for verifying the token's algorithm name and signature.
• The expected issuer value, which typically matches the Auth0 domain prefixed with https:// and suffixed with /.
• The expected audience value, which typically matches the Auth0 application client ID.

The type of SignatureVerifier used depends upon the signing algorithm used by your Auth0 application. You can view this value in your application settings under Advanced settings | OAuth | JsonWebToken Signature Algorithm. Auth0 recommends using the RS256 asymmetric signing algorithm. You can read more about signing algorithms here.

For asymmetric algorithms like RS256, use the AsymmetricSignatureVerifier class, passing the public URL where the certificates for the public keys can be found. This will typically be your Auth0 domain with the /.well-known/jwks.json path appended to it. For example, https://your-domain.auth0.com/.well-known/jwks.json.

For symmetric algorithms like HS256, use the SymmetricSignatureVerifier class, passing the value of the client secret of your Auth0 application.

The following example demonstrates the verification of an ID token signed with the RS256 signing algorithm:

from auth0.v3.authentication.token_verifier import TokenVerifier, AsymmetricSignatureVerifier

domain = 'myaccount.auth0.com'
client_id = 'exampleid'

# After authenticating
id_token = auth_result['id_token']

jwks_url = 'https://{}/.well-known/jwks.json'.format(domain)
issuer = 'https://{}/'.format(domain)

sv = AsymmetricSignatureVerifier(jwks_url)  # Reusable instance
tv = TokenVerifier(signature_verifier=sv, issuer=issuer, audience=client_id)
tv.verify(id_token)

If the token verification fails, a TokenValidationError will be raised. In that scenario, the ID token should be deemed invalid and its contents should not be trusted.

Organizations is a set of features that provide better support for developers who build and maintain SaaS and Business-to-Business (B2B) applications.

Using Organizations, you can: * Represent teams, business customers, partner companies, or any logical grouping of users that should have different ways of accessing your applications, as organizations. * Manage their membership in a variety of ways, including user invitation. * Configure branded, federated login flows for each organization. * Implement role-based access control, such that users can have different roles when authenticating in the context of different organizations. * Build administration capabilities into your products, using Organizations APIs, so that those businesses can manage their own organizations.

Note that Organizations is currently only available to customers on our Enterprise and Startup subscription plans.