IKAREM-OAUTH

Social login plus refresh tokens that survive audit.

pip install ikarem-oauth — Google/GitHub login via OAuth2 authorization-code flow and opaque refresh tokens done the production way: rotation, theft detection, revocation. Stdlib only, no new dependency. Part of IKAREM extensions.

app.register(OAuthPlugin(auth_secret="...",
    provider=github_provider("ID", "SECRET"), on_user=find_or_create))

01 — CODE FLOW

Login in two redirects.

GET /oauth/login?redirect_uri=… → 302 to the provider (PKCE challenge attached). GET /oauth/callback?code=&state= verifies single-use state, exchanges the code with the verifier, reads userinfo, calls your on_user(provider, info) hook (find-or-create — your users table, your rules), and returns {access_token, token_type, refresh_token}. Google and GitHub presets included; any provider is just URLs.

02 — ROTATION

Refresh tokens, production rules.

Tokens stored hashed (never plaintext). Every POST /oauth/token rotates: old dies, new pair issued. Replaying a rotated token means theft — the whole chain is revoked. POST /oauth/revoke logs out one token; revoke_all(sub) answers password changes and breaches. Access JWTs carry jti + scopes (enforce with core require_scopes); token endpoint speaks RFC 6749 (invalid_grant on 400, no-store everywhere).

03 — ENFORCED

Secure by default, not by documentation.

PKCE S256 on every flow. Exact redirect allowlists. HTTPS redirect URIs in production. Auth events on the ikarem_oauth logger for the SOC2 trail. Secrets from env, rate limits on /oauth/*, session rotation on login — the README's operate-it-right section states each one.

FAQ

Straight answers.

Google login in a Python API? Preset + hook, two redirects, tokens out.

Production refresh tokens? Opaque, hashed, rotated, revocable, reuse-detected.

PKCE or secret? Both, by default.

vs Authlib? Authlib covers the spec; this enforces the opinionated 20% with zero new dependencies.

KEEP GOING

Then attack it.

Logins deserve adversaries — ikarem-pentest fires auth-bypass and injection probes at the very routes you just guarded. Back to the extensions hub, the reference, or the guide.