View as .md

Flask (Authlib)

See the Applications overview for prerequisites, configuration endpoints, and available scopes.

Authlib (opens in new tab) provides OAuth and OpenID Connect client support for Flask. Key configuration:

  • Install authlib (opens in new tab), flask, and requests
  • Register the provider with server_metadata_url and code_challenge_method='S256' for PKCE
  • Set client_kwargs={'scope': 'openid email'}
  • The hardware attestation claim (hardware_verified) is in the access token JWT — decode the payload with base64url and padding adjustment
  • Callback URL: /callback

Example

web/flask-authlib (opens in new tab) — Complete working example with authorization code flow, PKCE, and hardware claim extraction.