[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_154":155},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":85,"_107":108,"_145":-5,"_146":11,"_147":17,"_148":11,"_149":-5,"_150":11,"_151":-5,"_152":153},"canonicalUrl","https://hub.docker.com/r/callstats/example-oauth2-server/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","callstats","reponame","example-oauth2-server","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2019-10-02T15:51:56.425816Z","description","Minor changes to the example-oauth2-server to facilitate the testing of oauth flows","is_private","last_updated","2019-10-02T16:07:26.962251Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",165,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# How to create an OAuth 2.0 Provider\n\nThis is an example of OAuth 2.0 server in [Authlib](https://authlib.org/).\nIf you are looking for old Flask-OAuthlib implementation, check the\n`flask-oauthlib` branch.\n\n- Documentation: \n- Authlib Repo: \n\n## Sponsors\n\n\n \n \n \n \n

If you want to quickly add secure token-based authentication to Python projects, feel free to check Auth0's Python SDK and free plan at auth0.com/overview.

\n\n## Take a quick look\n\nThis is a ready to run example, let's take a quick experience at first. To\nrun the example, we need to install all the dependencies:\n\n $ pip install -r requirements.txt\n\nSet Flask and Authlib environment variables:\n\n # disable check https (DO NOT SET THIS IN PRODUCTION)\n $ export AUTHLIB_INSECURE_TRANSPORT=1\n\nCreate Database and run the development server:\n\n $ flask run\n\nNow, you can open your browser with `http://127.0.0.1:5000/`, login with any\nname you want.\n\nBefore testing, we need to create a client:\n\n![create a client](https://user-images.githubusercontent.com/290496/38811988-081814d4-41c6-11e8-88e1-cb6c25a6f82e.png)\n\nGet your `client_id` and `client_secret` for testing. In this example, we\nhave enabled `password` grant types, let's try:\n\n $ curl -u ${client_id}:${client_secret} -XPOST http://127.0.0.1:5000/oauth/token -F grant_type=password -F username=${username} -F password=valid -F scope=profile\n\nBecause this is an example, every user's password is `valid`. For now, you\ncan read the source in example or follow the long boring tutorial below.\n\n**IMPORTANT**: To test implicit grant, you need to `token_endpoint_auth_method` to `none`.\n\n## Preparation\n\nAssume this example doesn't exist at all. Let's write an OAuth 2.0 server\nfrom scratch step by step.\n\n### Create folder structure\n\nHere is our Flask website structure:\n\n```\napp.py --- FLASK_APP\nwebsite/\n app.py --- Flask App Factory\n __init__.py --- module initialization (empty)\n models.py --- SQLAlchemy Models\n oauth2.py --- OAuth 2.0 Provider Configuration\n routes.py --- Routes views\n templates/\n```\n\n### Installation\n\nCreate a virtualenv and install all the requirements. You can also put the\ndependencies into `requirements.txt`:\n\n```\nFlask\nFlask-SQLAlchemy\nAuthlib\n```\n\n### Hello World!\n\nCreate a home route view to say \"Hello World!\". It is used to test if things\nworking well.\n\n\n```python\n# website/routes.py\nfrom flask import Blueprint\nbp = Blueprint(__name__, 'home')\n\n@bp.route('/')\ndef home():\n return 'Hello World!'\n```\n\n```python\n# website/app.py\nfrom flask import Flask\nfrom .routes import bp\n\ndef create_app(config=None):\n app = Flask(__name__)\n # load app sepcified configuration\n if config is not None:\n if isinstance(config, dict):\n app.config.update(config)\n elif config.endswith('.py'):\n app.config.from_pyfile(config)\n setup_app(app)\n return app\n\ndef setup_app(app):\n app.register_blueprint(bp, url_prefix='')\n```\n\n```python\n# app.py\nfrom website.app import create_app\n\napp = create_app({\n 'SECRET_KEY': 'secret',\n})\n```\n\nCreate an empty ```__init__.py``` file in the ```website``` folder.\n\nThe \"Hello World!\" example should run properly:\n\n $ FLASK_APP=app.py flask run\n\n## Define Models\n\nWe will use SQLAlchemy and SQLite for our models. You can also use other\ndatabases and other ORM engines. Authlib has some built-in SQLAlchemy mixins\nwhich will make it easier for creating models.\n\nLet's create the models in `website/models.py`. We need four models, which are\n\n- User: you need a user to test and create your application\n- OAuth2Client: the oauth client model\n- OAuth2AuthorizationCode: for `grant_type=code` flow\n- OAuth2Token: save the `access_token` in this model.\n\nCheck how to define these models in `website/models.py`.\n\nOnce you've created your own `website/models.py` (or copied our version), you'll need to import the database object `db`. Add the line `from .models import db` just after `from flask import Flask` in your scratch-built version of `website/app.py`.\n\nTo initialize the database upon startup, if no tables exist, you'll add a few lines to the `setup_app()` function in `website/app.py` so that it now looks like:\n\n```\ndef setup_app(app):\n # Create tables if they do not exist already\n @app.before_first_request\n def create_tables():\n db.create_all()\n\n db.init_app(app)\n app.register_blueprint(bp, url_prefix='')\n```\n\nYou can try running the app again as above to make sure it works.\n\n## Implement Grants\n\nThe source code is in `website/oauth2.py`. There are four standard grant types:\n\n- Authorization Code Grant\n- Implicit Grant\n- Client Credentials Grant\n- Resource Owner Password Credentials Grant\n\nAnd Refresh Token is implemented as a Grant in Authlib. You don't have to do\nanything on Implicit and Client Credentials grants, but there are missing\nmethods to be implemented in other grants. Check out the source code in\n`website/oauth2.py`.\n\nOnce you've created your own `website/oauth2.py`, import the oauth2 config object from the oauth2 module. Add the line `from .oauth2 import config_oauth` just after the import you added above in your scratch-built version of `website/app.py`.\n\nTo initialize the oauth object, add `config_oauth(app)` to the `setup_app()` function, just before the line that starts with `app.register_blueprint` so it looks like:\n\n```\ndef setup_app(app):\n # Create tables if they do not exist already\n @app.before_first_request\n def create_tables():\n db.create_all()\n\n db.init_app(app)\n config_oauth(app)\n app.register_blueprint(bp, url_prefix='')\n```\nYou can try running the app again as above to make sure it still works.\n\n## `@require_oauth`\n\nAuthlib has provided a `ResourceProtector` for you to create the decorator\n`@require_oauth`, which can be easily implemented:\n\n```py\nfrom authlib.flask.oauth2 import ResourceProtector\n\nrequire_oauth = ResourceProtector()\n```\n\nFor now, only Bearer Token is supported. Let's add bearer token validator to\nthis ResourceProtector:\n\n```py\nfrom authlib.flask.oauth2.sqla import create_bearer_token_validator\n\n# helper function: create_bearer_token_validator\nbearer_cls = create_bearer_token_validator(db.session, OAuth2Token)\nrequire_oauth.register_token_validator(bearer_cls())\n```\n\nCheck the full implementation in `website/oauth2.py`.\n\n\n## OAuth Routes\n\nFor OAuth server itself, we only need to implement routes for authentication,\nand issuing tokens. Since we have added token revocation feature, we need a\nroute for revoking too.\n\nCheckout these routes in `website/routes.py`. Their path begin with `/oauth/`.\n\n\n## Other Routes\n\nBut that is not enough. In this demo, you will need to have some web pages to\ncreate and manage your OAuth clients. Check that `/create_client` route.\n\nAnd we have an API route for testing. Check the code of `/api/me`.\n\n\n## Finish\n\nHere you go. You've got an OAuth 2.0 server.\n\nRead more information on .\n\n## License\n\nSame license with [Authlib](https://authlib.org/plans).\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",377479980,"orgData",{"_86":87,"_88":89,"_90":91,"_92":29,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_103":94,"_104":94,"_105":94,"_106":17},"id","1158cb15be5340a284b068fee89a3073","uuid","1158cb15-be53-40a2-84b0-68fee89a3073","type","organization","orgname","full_name","","location","Helsinki, Finland","company","callstats.io","profile_url","https://www.callstats.io","date_joined","2015-12-29T08:28:17.653534Z","gravatar_url","gravatar_email","badge","is_active","recentTags",[109],{"_110":40,"_111":112,"_113":114,"_86":115,"_116":117,"_46":134,"_135":112,"_136":29,"_137":52,"_53":138,"_139":140,"_141":125,"_142":134,"_143":62,"_144":17},"content_type","creator",568211,"full_size",377467252,71012299,"images",[118],{"_119":120,"_121":122,"_123":94,"_124":125,"_126":127,"_128":129,"_130":94,"_131":-5,"_132":114,"_59":62,"_133":-5},"architecture","amd64","digest","sha256:2442fee4d5cc1ce8b6742412405c48b9e640e638c115f17ee2578789eb89131b","features","last_pulled","2026-09-23T21:24:00.713052898Z","last_pushed","2019-10-02T16:07:27Z","os","linux","os_features","os_version","size","variant","2019-10-02T16:07:26.547317Z","last_updater","last_updater_username","media_type","v1.0.1","repository",7791963,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":156,"_163":164,"_152":173,"_174":11},{"_36":157,"_38":158,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":159,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":160,"_75":11,"_76":162,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":161},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_165":60,"_166":-5,"_167":-5,"_168":169},"count","next","previous","results",[170],{"_110":40,"_111":112,"_113":114,"_86":115,"_116":171,"_46":134,"_135":112,"_136":29,"_137":52,"_53":138,"_139":140,"_141":125,"_142":134,"_143":62,"_144":17},[172],{"_119":120,"_121":122,"_123":94,"_124":125,"_126":127,"_128":129,"_130":94,"_131":-5,"_132":114,"_59":62,"_133":-5},[],"canDeleteTags","actionData","errors"]

callstats/example-oauth2-server

Tags for callstats/example-oauth2-server