aiohttp

Just want one protected handler? Start with the aiohttp quickstart.

authdog.aiohttp is middleware plus a require_auth wrapper for aiohttp handlers. Other Python frameworks: FastAPI, Django, Flask, Starlette. Hub: Python.

Availability and install

Unreleased on PyPI. Source-only in `packages/python`. Python 3.10+, aiohttp 3.9+, httpx 0.27+.

python -m pip install "./packages/python[aiohttp]"

Configure

import os
from authdog.aiohttp import Authdog

authdog = Authdog(public_key=os.environ["PK_AUTHDOG"])

Add authdog.middleware to the aiohttp application. The public key is publishable. Construction rejects malformed keys and identity hosts outside the trusted HTTPS allowlist.

Session and gate

Bindings are async. await session(request) is optional context. @require_auth is the 401 boundary.

from aiohttp import web

async def index(request):
    ctx = await authdog.session(request)
    return web.json_response({"authenticated": ctx.is_authenticated})

@authdog.require_auth
async def me(request):
    ctx = await authdog.session(request)
    return web.json_response(ctx.user)

async def logout(request):
    return authdog.logout(request)

app = web.Application(middlewares=[authdog.middleware])
app.router.add_get("/", index)
app.router.add_get("/me", me)
app.router.add_get("/logout", logout)

logout raises aiohttp HTTPFound, following that framework’s redirect convention.

Shared rules

The resolver prefers authdog-session, then Authorization: Bearer <token>. fetch_user=False leaves is_authenticated false, so the wrapper rejects. Apply authorization after the gate.

Self-hosted identity hosts need AUTHDOG_ALLOWED_IDENTITY_HOSTS.