We recently released version 1.7 of Authlib, which includes:

• migration to joserfc as the replacement for the authlib.jose module. joserfc is based on authlib.jose but is a more modern library. The API have slightly evolved, and it includes new things, like type hints for instance. Read the authlib joserfc migration instructions for more details.
• support for OpenID Connect RP-Initiated Logout. This specification details how client applications can close user sessions at the Identity Provider. Combined with the coming OpenID Connect Back-Channel Logout (which does the opposite) it allows for centralized log-out among an entire application ecosystem.
• and of course, tons of bugfixes and polishing.

NLNet

In december 2025 we were accepted in the NLNet NGI0 grant. We want to thank warmfuly the NLNet Foundation for supporting us maintaining and developing Authlib. The joserfc migration as well as the OIDC RPinitiated implementation were the two first tasks we commited to achieve.

The next steps that we will tackle as part of this grant are:

• bug triaging and fixing. We know some tickets are waiting since a long time, and we plan to spend time on them.
• Type hints
• Async support
• FastAPI support
• OpenID Connect Back-Channel Logout
• OpenID Foundation Certification for the client-side, with auth-playground
• OpenID Foundation Certification for the server-side, by resurrecting and cleaning-up example-oauth2-server
• Security Audit with Radically Open Security

Stay tuned!

However, some companies have chosen to implement alternative signature methods for OAuth 1.0, such as HMAC-SHA256. While our documentation provides an example of how to create a server using this method, we currently lack documentation for the client-side implementation. Nevertheless, implementing the HMAC-SHA256 signature method on the client side is a relatively straightforward task.

Let's take a look at the code in authlib.oauth1.rfc5849.signature. The HMAC-SHA1 signature method is defined as follows:

def hmac_sha1_signature(base_string, client_secret, token_secret):
    text = base_string
    key = escape(client_secret or '')
    key += '&'
    key += escape(token_secret or '')
    signature = hmac.new(to_bytes(key), to_bytes(text), hashlib.sha1)
    sig = binascii.b2a_base64(signature.digest())[:-1]
    return to_unicode(sig)

def sign_hmac_sha1(client, request):
    base_string = generate_signature_base_string(request)
    return hmac_sha1_signature(base_string, client.client_secret, client.token_secret)

To implement the HMAC-SHA256 signature method, it's quite straightforward. We can essentially copy the HMAC-SHA1 signature method and make one key change, replacing the SHA1 hash method with SHA256:

def hmac_sha256_signature(base_string, client_secret, token_secret):
    text = base_string
    key = escape(client_secret or '')
    key += '&'
    key += escape(token_secret or '')
    signature = hmac.new(to_bytes(key), to_bytes(text), hashlib.sha256)
    sig = binascii.b2a_base64(signature.digest())[:-1]
    return to_unicode(sig)

def sign_hmac_sha256(client, request):
    base_string = generate_signature_base_string(request)
    return hmac_sha256_signature(base_string, client.client_secret, client.token_secret)

By making this modification, you'll have an HMAC-SHA256 signature method that mirrors the structure of the HMAC-SHA1 method but uses SHA256 for hashing.

And finally, you need to register the signature method:

from authlib.oauth1 import ClientAuth

ClientAuth.register_signature_method("HMAC-SHA256", sign_hmac_sha256)

Once you've registered the HMAC-SHA256 signature method, you can use it in all your OAuth 1.0 clients.

• ES256: ECDSA using P-256 and SHA-256
• ES384: ECDSA using P-384 and SHA-384
• ES512: ECDSA using P-521 and SHA-512

It is very easy to generate an EC key using openssl. But if you are not familiar with openssl, here are some commands that you can just copy and use. I assume you have openssl installed.

EC key with crv P-256

This key can be used for the alg: ES256, the commands below will generate the private and public keys:

# generate a private key
openssl ecparam -name prime256v1 -genkey -noout -out ec-p256-private.pem

# extract the public key
openssl ec -in ec-p256-private.pem -pubout -out ec-p256-public.pem

Note: OpenSSL encourages using prime256v1 instead of secp256r1.

EC key with crv P-384

This key can be used for alg: ES384:

# generate a private key
openssl ecparam -name secp384r1 -genkey -noout -out ec-p384-private.pem

# extract the public key
openssl ec -in ec-p384-private.pem -pubout -out ec-p384-public.pem

EC key with crv P-512

This key can be used for alg: ES512:

# generate a private key
openssl ecparam -name secp521r1 -genkey -noout -out ec-p512-private.pem

# extract the public key
openssl ec -in ec-p512-private.pem -pubout -out ec-p512-public.pem

Note: It is secp521r1, not secp512r1. But the "crv" value in EC Key is "P-512".

EC key with crv secp256k1

This key is used for ECDSA Signature with secp256k1 Curve defined by RFC8812.

• ES256K: ECDSA using secp256k1 and SHA-256

# generate a private key
openssl ecparam -name secp256k1 -genkey -noout -out ec-secp256k1-private.pem

# extract the public key
openssl ec -in ec-secp256k1-private.pem -pubout -out ec-secp256k1-public.pem

It is created on top of Starlette. A FastAPI app is basically a Starlette app, that is why you can just use Authlib Starlette integration to create OAuth clients for FastAPI.

We have a post on How to create a Twitter login for FastAPI, in this post we will use Google as an example.

Create OAuth client

A typical OAuth client for Starlette or FastAPI:

from authlib.integrations.starlette_client import OAuth
from starlette.config import Config

config = Config('.env')  # read config from .env file
oauth = OAuth(config)
oauth.register(
    name='google',
    server_metadata_url='https://accounts.google.com/.well-known/openid-configuration',
    client_kwargs={
        'scope': 'openid email profile'
    }
)

We don't need to add client_id and client_secret here, because they are in .env file. You are not supposed to hard code them in the code in real products.

This configuration is very different than Twitter. Since Google has an OpenID discovery endpoint, we can use this URL for server_metadata_url. Authlib will fetch this server_metadata_url to configure the OAuth client for you.

Implement login route

First, create a FastAPI application:

from fastapi import FastAPI
from starlette.middleware.sessions import SessionMiddleware

app = FastAPI()
app.add_middleware(SessionMiddleware, secret_key="secret-string")

We need this SessionMiddleware, because Authlib will use request.session to store temporary codes and states.

Next, the /login route will redirect us to Google website to grant access:

@app.route('/login')
async def login(request: Request):
    # absolute url for callback
    # we will define it below
    redirect_uri = request.url_for('auth')
    return await oauth.google.authorize_redirect(request, redirect_uri)

The above code will redirect you to Google account website.

Handle authentication callback

When you grant access from Google website, Google will redirect back to your given redirect_uri, which is request.url_for('auth'):

@app.route('/auth')
async def auth(request: Request):
    token = await oauth.google.authorize_access_token(request)
    # <=0.15
    # user = await oauth.google.parse_id_token(request, token)
    user = token['userinfo']
    return user

The above code will obtain a token which contains access_token and id_token. An id_token contains user info, we just need to parse it to get the login user's information.

Hint

You can check the full example: https://github.com/authlib/demo-oauth-client/tree/master/fastapi-google-login.

It is created on top of Starlette. A FastAPI app is basically a Starlette app, that is why you can just use Authlib Starlette integration to create OAuth clients for FastAPI.

Create OAuth client

A typical OAuth client for Starlette or FastAPI:

from authlib.integrations.starlette_client import OAuth
from starlette.config import Config

config = Config('.env')  # read config from .env file
oauth = OAuth(config)

We will create a twitter login example for FastAPI. Like all web frameworks integrations in Authlib, we need to register a remote:

oauth.register(
    name='twitter',
    api_base_url='https://api.twitter.com/1.1/',
    request_token_url='https://api.twitter.com/oauth/request_token',
    access_token_url='https://api.twitter.com/oauth/access_token',
    authorize_url='https://api.twitter.com/oauth/authenticate',
)

We don't need to add client_id and client_secret here, because they are in .env file. You are not supposed to hard code them in the code in real products.

Implement login route

First, create a FastAPI application:

from fastapi import FastAPI
from starlette.middleware.sessions import SessionMiddleware

app = FastAPI()
app.add_middleware(SessionMiddleware, secret_key="secret-string")

We need this SessionMiddleware, because Authlib will use request.session to store temporary codes and states.

Next, the /login route will redirect us to Twitter website to grant access:

@app.route('/login')
async def login(request: Request):
    # absolute url for callback
    # we will define it below
    redirect_uri = request.url_for('auth')
    return await oauth.twitter.authorize_redirect(request, redirect_uri)

The above code will exchange request_token and redirect to Twitter website for you.

Handle authentication callback

When you grant access from Twitter website, twitter will redirect back to your given redirect_uri, which is request.url_for('auth'):

@app.route('/auth')
async def auth(request: Request):
    token = await oauth.twitter.authorize_access_token(request)
    url = 'account/verify_credentials.json'
    resp = await oauth.twitter.get(
        url, params={'skip_status': True}, token=token)
    user = resp.json()
    return user

The above code will exchange an access_token. You can use the token to access users' resources. In the above example, we are requesting the authenticated user's profile information.

Hint

You can register a Twitter OAuth Client at https://developer.twitter.com/en/apps. Remember to add the full auth url in Callback URL.

You can check the full example: https://github.com/authlib/demo-oauth-client/tree/master/fastapi-twitter-login.

What if we can upload files from browser to cloud storage directly? Wouldn't that be wonderful? There are lots of guides on how to do this with S3, but not Google Cloud Storage.

Google however has provided a document for you to upload objects by HTML forms. The API is called POST Object API.

Good luck. I hope you can understand the documentation. If not, here is a little tips on how to do it:

1. We need to get a Google service account, which can be created on Service accounts page
2. We need to create a backend API to generate form fields for uploading
3. Then use the form fields in your front end, submit the form to Google Cloud Storage

The most difficult part is how to generate the form fields. Here is how:

import json
import datetime

with open('your-google-credential.json') as f:
    conf = json.load(f)

BUCKET = 'your-bucket'

def create_upload_fields(key, content_type, cache_control, acl='public-read'):
    # step 1. prepare form fields
    fields = [
        {'acl': acl},
        {'key': name},
        {'bucket': bucket},
        {'Content-Type': content_type},
    ]
    # you may add more fields
    if cache_control:
        fields.append({'Cache-Control': cache_control})

    # step 2. prepare policy json
    now = datetime.datetime.utcnow()
    # you may set a different expire time
    expires_at = now + datetime.timedelta(minutes=2)
    expiration = expires_at.strftime('%Y-%m-%dT%H:%M:%SZ')
    conditions = list(fields)
    # you may extend conditions here
    policy_json = {
        'expiration': expiration,
        'conditions': conditions
    }
    
    # step 3. base64 policy
    policy_text = json.dumps(policy_json, separators=(',', ':'))
    policy = base64.b64encode(policy_text.encode('utf-8'))
    
    # step 4. sign policy
    signature = base64.b64encode(sign_policy(policy))
    
    # step 5. return fields
    fields.extend([
        {'GoogleAccessId': conf['client_email']},
        {'policy': policy.decode('utf-8')},
        {'signature': signature.decode('utf-8')},
    ])
    return fields

The code above has a sign_policy not implemented. We will define it as another method to make our code more readable. This sign_policy will use RSA to sign, we need to install a third party library to do this. My suggestion is cryptography:

pip install cryptography

You may encounter troubles with installation, check out the installation guide of cryptography.

Here is our code for sign_policy:

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.serialization import load_pem_private_key

def sign_policy(policy):
    private_key = load_pem_private_key(
        conf['private_key'].encode('utf-8'),  # conf: check above code
        password=None,
        backend=default_backend(),
    )
    return private_key.sign(policy, padding.PKCS1v15(), hashes.SHA256())

This is a RS256 sign, you may find it is very hard to understand, that is ok. Crypto is hard, but using the library is not, just use the sign_policy code.

With the form fields created by create_upload_fields, you can create the HTML form like:

<form action="https://storage.googleapis.com" method="post" enctype="multipart/form-data">
<input type="text" name="key" value="some-key-value">
<input type="hidden" name="bucket" value="your-bucket">
<input type="hidden" name="Content-Type" value="image/jpeg">
<input type="hidden" name="GoogleAccessId" value="1234567890123@developer.gserviceaccount.com">
<input type="hidden" name="acl" value="bucket-owner-read">
<input type="hidden" name="policy" value=".....">
<input type="hidden" name="signature" value="....">

<input name="file" type="file">
<input type="submit" value="Upload">
</form>

Remember to put <input name="file" type="file"> at the end of form.

You can add more fields and conditions to your form, read the offical guide to find out what they are.

Also, you may be interested in Multipart Upload to Google Cloud Storage with Authlib.

Need a more detailed guide? Patreon me at https://www.patreon.com/lepture, I'll create a video guide on uploading to Google Cloud Storage from a single page application (SPA).

The license issue has been there for a long time. APGL has prevented many people from using Authlib, it is a time to make a change. Authlib will be licensed under BSD from next release v0.11.

The commercial license is still available. New commercial plans will be listed on the pricing page.

Happy new license, happy new year.

Here is the GitHub commit.

Why Authlib

The OAuth client implementation in Flask-OAuthlib is very bad. I didn't mean the API design, oh, the API methods are quite good, and Authlib shares a similar API. However, Flask-OAuthlib is using the built-in urllib2 or urllib, which makes things terrible.

There was once a plan to replace them with requests, but it didn't happen until I made the new Authlib, which is another story. The client part is powered by requests in Authlib, which handles http well and correct.

Initialize

We will focus on the differences between Flask-OAuthlib and the Flask integration in Authlib. Although Authlib has Django integration as well.

The oauth registries are similar, but with different parameters:

from flask_oauthlib.client import OAuth
oauth = OAuth(app)

twitter = oauth.remote_app('twitter',
    base_url='https://api.twitter.com/1.1/',
    request_token_url='https://api.twitter.com/oauth/request_token',
    access_token_url='https://api.twitter.com/oauth/access_token',
    authorize_url='https://api.twitter.com/oauth/authenticate',
    consumer_key='<your key here>',
    consumer_secret='<your secret here>'
)

from authlib.integrations.flask_client import OAuth

oauth = OAuth(app)
twitter = oauth.register('twitter',
    client_id='Twitter Consumer Key',
    client_secret='Twitter Consumer Secret',
    request_token_url='https://api.twitter.com/oauth/request_token',
    access_token_url='https://api.twitter.com/oauth/access_token',
    authorize_url='https://api.twitter.com/oauth/authenticate',
    api_base_url='https://api.twitter.com/1.1/',
)

Configuration

Those parameters in .remote_app (Flask-OAuthlib) and .register (Authlib) can be loaded with configurations too. Get the differences in the official documentations:

1. Flask-OAuthlib Lazy Configuration
2. Authlib Flask Configuration

Methods

The workflow of an OAuth authorization has two steps both in Flask-OAuthlib and Authlib:

1. redirect to the service's login page
2. back to our authenticated page

In Flask-OAuthlib, it looks like:

@app.route('/login')
def login():
    redirect_uri = url_for('authorize', _external=True)
    return oauth.twitter.authorize(callback=redirect_uri)

@app.route('/authorize')
def authorize():
    resp_data = oauth.twitter.authorized_response()
    # do something with response data

In Authlib, it looks like:

@app.route('/login')
def login():
    redirect_uri = url_for('authorize', _external=True)
    return oauth.twitter.authorize_redirect(redirect_uri)

@app.route('/authorize')
def authorize():
    token = oauth.twitter.authorize_access_token()
    # do something with the token

The client parts are very simple, what you need to change is the initialization part and the authorization routes, there is nothing difficult.

Token

If you want to access resource with methods like oauth.twitter.get(...), you will need to make sure there is a ready to use access token. This part is very different between Flask-OAuthlib and Authlib.

In Flask-OAuthlib, it is handled by a decorator:

@twitter.tokengetter
def get_twitter_oauth_token():
    token = fetch_from_somewhere()
    return token

The token returned by tokengetter can be a tuple or a dict. But in Authlib, it can only be a dict, and Authlib doesn't use a decorator to fetch token, instead, you should pass this function to the registry:

# register the two methods
oauth.register('twitter',
    client_id='Twitter Consumer Key',
    client_secret='Twitter Consumer Secret',
    request_token_url='https://api.twitter.com/oauth/request_token',
    request_token_params=None,
    access_token_url='https://api.twitter.com/oauth/access_token',
    access_token_params=None,
    refresh_token_url=None,
    authorize_url='https://api.twitter.com/oauth/authenticate',
    api_base_url='https://api.twitter.com/1.1/',
    client_kwargs=None,
    # NOTICE HERE
    fetch_token=fetch_twitter_token,
    save_request_token=save_request_token,
    fetch_request_token=fetch_request_token,
)

Please note, that Flask-OAuthlib is saving request token in Flask.session which will expose the request token in HTTP transport. In Authlib, you need to save it in other place, like a cache or database. Find more in Authlib Documentation

Others

There is a authorized_handler decorator in Flask-OAuthlib which is not recommended anymore. This decorator is not in Authlib. You need to call oauth.twitter.authorize_access_token in the route yourself.

And we have a demo repo: https://github.com/authlib/demo-oauth-client

• Visit Authlib Homepage
• Get more information in Authlib Documentation
• Browser Authlib Source Code

Why use Authlib

But why do you want to use Authlib instead of oauth2client?

1. Authlib AssertionSession and gspread are both using requests, you don't have to use another http library
2. Authib will automatically refresh access token, while oauth2client in gspread can't. (but oauth2client itself can)
3. Unlike oauth2client, you know exactly what's going on in Authlib, it is a white box
4. Oh, oauth2client is deprecated.

What is AssertionSession

Authlib has just released version 0.7. In this version, Authlib has provided a AssertionSession which is a client implementation of RFC7523. That has been said, Google's so called service account is actually JWT for Authorization Grants. You can get a bearer token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and a JWT assertion.

POST /token.oauth2 HTTP/1.1
Host: authz.example.net
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.eyJpc3Mi[...omitted for brevity...]

And this is what AssertionSession is doing. It will get a valid OAuth token automatically, prepare a requests session for you to use. Yes, it is just a requests session.

How to use Authlib

Here is the simple code:

import json
from authlib.integrations.requests_client import AssertionSession

def create_assertion_session(conf_file, scopes, subject=None):
    with open(conf_file, 'r') as f:
        conf = json.load(f)

    token_url = conf['token_uri']
    issuer = conf['client_email']
    key = conf['private_key']
    key_id = conf.get('private_key_id')

    header = {'alg': 'RS256'}
    if key_id:
        header['kid'] = key_id

    # Google puts scope in payload
    claims = {'scope': ' '.join(scopes)}
    return AssertionSession(
        grant_type=AssertionSession.JWT_BEARER_GRANT_TYPE,
        token_endpoint=token_url,
        issuer=issuer,
        audience=token_url,
        claims=claims,
        subject=subject,
        key=key,
        header=header,
    )

scopes = [
    'https://spreadsheets.google.com/feeds',
    'https://www.googleapis.com/auth/drive',
]
session = create_assertion_session('your-google-conf.json', scopes)

And then use this session in gspread:

from gspread import Client

gc = Client(None, session)

wks = gc.open("Where is the money Lebowski?").sheet1

wks.update_acell('B2', "it's down there somewhere, let me take another look.")

# Fetch a cell range
cell_list = wks.range('A1:B7')

You can use it directly, there is no need to call .login() method.

Find more information on Authlib Documentation.

• Authlib Repository
• Authlib Homepage
• Authlib Documentation

Auth0 has sponsored many open source projects, including my previous Flask-OAuthlib. I'm happy to take it as a sponsor for Authlib. I do encourage you to have a try on their service, it is quite easy and in most case it is free. I find it quite useful for single page application.

Here is a total free use case. Consider that you have some single page applications that only allows your company members to access. You don't have to create a server for it, just use Auth0.com, and embed it in your SPA, no one piece of backend code for authentication. You can use a simple domain whitelist to allow ONLY your company members to access the SPA. Your company members won't exceed 7,000 free active users, right?

Thanks again for Auth0's sponsoring Authlib. BTW, Auth0 has many open source projects too. And Authlib has a built-in integration with Auth0 via loginpass.

If you have interests in sponsoring Authlib, please contact me@lepture.com. I accept three sponsors in total ONLY. Your brand will be listed on:

• GitHub Readme: https://github.com/lepture/authlib
• Documentation Sidebar: https://docs.authlib.org/

First, let's create a requests session with Google service account config file, its scope is https://www.googleapis.com/auth/cloud-platform. Remember to turn Google Storage API on in cloud console.

import json
# before v0.13
from authlib.client import AssertionSession
# after v0.13
from authlib.integrations.requests_client import AssertionSession

def create_assertion_session(conf_file, scope, subject=None):
    with open(conf_file, 'r') as f:
        conf = json.load(f)

    token_url = conf['token_uri']
    issuer = conf['client_email']
    key = conf['private_key']
    key_id = conf.get('private_key_id')

    header = {'alg': 'RS256'}
    if key_id:
        header['kid'] = key_id

    # Google puts scope in payload
    claims = {'scope': scope}
    return AssertionSession(
        grant_type=AssertionSession.JWT_BEARER_GRANT_TYPE,
        token_url=token_url,
        issuer=issuer,
        audience=token_url,
        claims=claims,
        subject=subject,
        key=key,
        header=header,
    )

session = create_assertion_session('your-google-conf.json', 'https://www.googleapis.com/auth/cloud-platform')

You can always use the GoogleServiceAccount in loginpass so that you don't need to write the code above. Instead, it can be as simple as:

from loginpass.google import GoogleServiceAccount

session = GoogleServiceAccount.from_service_account_file('your-google-conf.json', 'https://www.googleapis.com/auth/cloud-platform')

This session is a requests session, which has the same API as requests, such as requests.get, requests.post. Reading the documentation from Google website on JSON API: Performing a Multipart Upload, let's figure out what should we do.

1. figure out what metadata should we send
2. create a multipart form as the POST payload

We will use requests-toolbelt to create the Multipart Form, which can also sending streaming data. The code will look like:

import json
from requests_toolbelt import MultipartEncoder

bucket = 'your-bucket-name'
url = 'https://www.googleapis.com/upload/storage/v1/b/{}/o?uploadType=multipart'.format(bucket)
# file name to be saved in bucket
name = 'foo/bar.jpg'

metadata = {
    'name': name,
    'cacheControl': 'public, max-age=5184000'
}

# obj can be a file / bytes or anything that requests support
obj = open('example.jpg', 'rb')
files = [
    ('file', (name, json.dumps(metadata), 'application/json')),
    ('file', (name, obj, 'image/jpeg')),
]
encoder = MultipartEncoder(files)
headers = {'Content-Type': encoder.content_type}
# use the session created above
resp = session.post(url, data=encoder, headers=headers)

The metadata in this example contains a name and cacheControl, between which, the name is required, and you can add more metadata if you want.

Checking our guide - Upload to Google Cloud Storage from browser directly.

What is Google Analytics API

Basically, it is an OAuth POST request to the v4 reporting API:

POST /v4/reports:batchGet HTTP/1.1
Host: analyticsreporting.googleapis.com
Content-Type: application/json
Authorization: Bearer string-of-token

{
  "reportRequests":
  [
    {
      "viewId": "XXXX",
      "dateRanges": [{"startDate": "2014-11-01", "endDate": "2014-11-30"}],
      "metrics": [{"expression": "ga:users"}]
    }
  ]
}

The main trouble is to get the OAuth token which can be solved by the official python client. You can also use Authlib to get the OAuth access token, which would be better to understand.

How to Get Token

Authlib has just released version 0.7. In this version, Authlib has provided a AssertionSession which is a client implementation of RFC7523. That has been said, Google's so called service account is actually JWT for Authorization Grants. You can get a bearer token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and a JWT assertion.

POST /token.oauth2 HTTP/1.1
Host: authz.example.net
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.eyJpc3Mi[...omitted for brevity...]

And this is what AssertionSession is doing. It will get a valid OAuth token automatically, prepare a requests session for you to use. Yes, it is just a requests session.

Build an Example

Let's take a look at what we are going to build. This is a Google Analytics charts in Typlog dashboard.

First, we need to get a Google service account, which can be created on Service accounts page. Then, we can use the provided JSON file to create a AssertionSession.

import json
from authlib.integrations.requests_client import AssertionSession

def create_assertion_session(conf_file, scope, subject=None):
    with open(conf_file, 'r') as f:
        conf = json.load(f)

    token_endpoint = conf['token_uri']
    issuer = conf['client_email']
    key = conf['private_key']
    key_id = conf.get('private_key_id')

    header = {'alg': 'RS256'}
    if key_id:
        header['kid'] = key_id

    # Google puts scope in payload
    claims = {'scope': scope}
    return AssertionSession(
        token_endpoint=token_endpoint,
        issuer=issuer,
        claims=claims,
        subject=subject,
        key=key,
        header=header,
    )

session = create_assertion_session('your-google-conf.json', 'https://www.googleapis.com/auth/analytics.readonly')

This session is a requests session, which has all the requests methods, like get, post, put, etc. The next thing is to create the POST payload, which would be:

report = {
    'viewId': 'XXX',
    'dateRanges': [
        {'startDate': '2018-04-01', 'endDate': '2018-05-01'},
    ],
    'metrics': [
        {'expression': 'ga:pageviews'},
        {'expression': 'ga:sessions'},
        {'expression': 'ga:users'},
    ],
    'dimensions': [
        {'name': 'ga:date'}
    ],
}

BATCH_GET_URL = 'https://analyticsreporting.googleapis.com/v4/reports:batchGet'
resp = session.post(BATCH_GET_URL, json={'reportRequests': [report]})
print(resp.json())

You can return the JSON response to the browsers, and the last thing is to build a chart in JS with the response JSON. I'm using chart.js, you can also use other libraries.

Build reportRequests

There is a report in the above section which is the payload to send to Google Analytics API. But how to create such a payload? You can learn it from the official documentation. I will show you some examples of the requests in Typlog.

A single post analytics data

post_filter = {
    'dimensionName': 'ga:pagePath',
    'operator': 'EXACT',
    'expressions': post_page_path
}
site_filter = {
    'dimensionName': 'ga:dimension1',
    'operator': 'EXACT',
    'expressions': site_id
}
base_report = {
    'viewId': view_id,
    'dateRanges': [
        {'startDate': start, 'endDate': end},
    ],
    'dimensionFilterClauses': {
        'filters': [site_filter, post_filter],
        'operator': 'AND'
    }
}
visit_report = {
    'metrics': [
        {'expression': 'ga:pageviews'},
        {'expression': 'ga:sessions'},
    ],
    'dimensions': [
        {'name': 'ga:date'}
    ]
}
referrer_report = {
    'metrics': [
        {'expression': 'ga:pageviews'},
        {'expression': 'ga:sessions'},
    ],
    'dimensions': [
        {'name': 'ga:fullReferrer'}
    ]
}
visit_report.update(base_report)
referrer_report.update(base_report)
reports = [visit_report, referrer_report]

resp = session.post(BATCH_GET_URL, json={'reportRequests': reports})

In this example, it has two reports, visit_report is used to create a chart of visits information, and referrer_report is used to create a table of referrer information.

• Authlib Repository
• Authlib Homepage
• Authlib Documentation

There is a ready to use GoogleServiceAccount implementation in loginpass.

I find it really hard to continue the development of Flask-OAuthlib, both on code and time. At that moment, OAuthlib, the library it depends was in a very bad status (now it is moved into an org), the APIs it provided are not good enough, or not of my taste. And I barely have much time or enthusiasm to fix the issues.

That's why I created Authlib with a sustainable idea from the beginning. Get a better idea by reading Announcement of Authlib.