Helpers for working with the act claim on verified access token claims.
\n| \n | \n |
| \nReturn the current actor from the outermost act.sub, if present. | \n
| \nReturn the delegation chain from newest actor to oldest actor. | \n
Return the current actor from the outermost act.sub, if present.
\nOnly the outermost act.sub should be used for authorization decisions.\nNested act values represent prior actors and are informational.
\nReturn the delegation chain from newest actor to oldest actor.
\nThe first entry is the current actor (outermost act.sub). Later entries are\nprior actors from nested act values and are typically most useful for audit\nand attribution.
\n| \n | \n |
| \n | \n |
| \n | \n |
| \n | \n |
| \n | \n |
| \n | The main class for discovering OIDC metadata (issuer, jwks_uri) and verifying | \n
The main class for discovering OIDC metadata (issuer, jwks_uri) and verifying\nAuth0-issued JWT access tokens in an async environment.
\nCheck if DPoP authentication is required.
\nIf scheme is \u2018DPoP\u2019, verifies both access token and DPoP proof
If scheme is \u2018Bearer\u2019, verifies only the access token
Note
\nAuthorization header parsing uses split(None, 1) to correctly handle\ntabs and multiple spaces per HTTP specs. Malformed headers with multiple\nspaces now raise VerifyAccessTokenError during JWT parsing (previously\nraised InvalidAuthSchemeError).
\nheaders \u2013 HTTP headers dict containing (header keys should be lowercase):\n- \u201cauthorization\u201d: The Authorization header value (required)\n- \u201cdpop\u201d: The DPoP proof header value (required for DPoP)
http_method \u2013 The HTTP method (required for DPoP)
http_url \u2013 The HTTP URL (required for DPoP, also used for MCD resolver context)
The decoded access token claims, including act when present.
\nMissingRequiredArgumentError \u2013 If required args are missing
InvalidAuthSchemeError \u2013 If an unsupported scheme is provided
InvalidDpopProofError \u2013 If DPoP verification fails
VerifyAccessTokenError \u2013 If access token verification fails
AuthServerUnavailableError \u2013 If the OIDC discovery document or JWKS cannot be reached
Asynchronously verifies the provided JWT access token.
\nFetches OIDC metadata and JWKS if not already cached.
Decodes and validates signature (RS256) with the correct key.
Checks standard claims: \u2018iss\u2019, \u2018aud\u2019, \u2018exp\u2019, \u2018nbf\u2019, \u2018iat\u2019
Checks extra required claims if \u2018required_claims\u2019 is provided.
Enforces organization_policy: requires \u2018org_id\u2019 when set to \u201crequired\u201d,\nand checks it against organization_id when an allowlist is configured.
access_token \u2013 The JWT access token to verify
request_url \u2013 Optional request URL for dynamic domain resolvers
request_headers \u2013 Optional request headers dict for dynamic domain resolvers
required_claims \u2013 Optional list of additional claim names that must be present
The decoded token claims if valid, including act when present.
\nMissingRequiredArgumentError \u2013 If no token is provided.
VerifyAccessTokenError \u2013 If verification fails (signature, claims mismatch, etc.).
DomainsResolverError \u2013 If domains resolver function fails.
MissingOrganizationError \u2013 If organization_policy is \u201crequired\u201d and the token has no org_id claim.
OrganizationNotAllowedError \u2013 If the token\u2019s org_id is not in the organization_id allowlist.
AuthServerUnavailableError \u2013 If the OIDC discovery document or JWKS cannot be reached.
Single well-formed compact JWS
typ=\u201ddpop+jwt\u201d, alg\u2208allowed, alg\u2260none
jwk header present & public only
Signature verifies with jwk
5. Validates all required claims\nRaises InvalidDpopProofError on any failure.
\nRetrieves a token for a connection.
\noptions \u2013 Options for retrieving an access token for a connection.\nMust include \u2018connection\u2019 and \u2018access_token\u2019 keys.\nMay optionally include \u2018login_hint\u2019.
verified \u2013 The already-verified token, supplied by a caller that has verified it (for\nexample an MCP server). When omitted and a token_store is configured, the\ntoken is verified here before any cache lookup.
GetAccessTokenForConnectionError \u2013 If there was an issue requesting the access token.
ApiError \u2013 If the token exchange endpoint returns an error.
VerifyAccessTokenError \u2013 If a store is configured and either verified is omitted and the token fails verification, or verified is supplied but does not match the access token being exchanged.
MissingOrganizationError \u2013 If a store is configured, verified is omitted, organization_policy is \u201crequired\u201d and the token has no org_id claim.
OrganizationNotAllowedError \u2013 If a store is configured, verified is omitted and the token\u2019s org_id is not in the organization_id allowlist.
AuthServerUnavailableError \u2013 If a store is configured, verified is omitted and the OIDC discovery document or JWKS cannot be reached.
Dictionary containing the token response with access_token, expires_in, and scope.
\nExchange a subject token for an Auth0 token using RFC 8693.
\nThe matching Token Exchange Profile is selected by subject_token_type.\nThis method requires a confidential client (client_id and client_secret must be configured).
\nsubject_token \u2013 The token to be exchanged
subject_token_type \u2013 URI identifying the token type (must match a Token Exchange Profile)
audience \u2013 Optional target API identifier for the exchanged tokens
scope \u2013 Optional space-separated OAuth 2.0 scopes to request
requested_token_type \u2013 Optional type of token to issue (defaults to access token)
extra \u2013 Optional additional parameters sent as form fields to Auth0.\nAll values are converted to strings before sending.\nArrays are limited to 20 values per key for DoS protection.\nCannot override reserved OAuth parameters (case-insensitive check).
access_token (str): The Auth0 access token
expires_in (int): Token lifetime in seconds
expires_at (int): Absolute expiration time as a Unix timestamp in seconds, calculated by the SDK from expires_in
id_token (str, optional): OpenID Connect ID token
refresh_token (str, optional): Refresh token
scope (str, optional): Granted scopes
token_type (str, optional): Token type (typically \u201cBearer\u201d)
issued_token_type (str, optional): RFC 8693 issued token type identifier
Dictionary containing
\nMissingRequiredArgumentError \u2013 If required parameters are missing
GetTokenByExchangeProfileError \u2013 If client credentials not configured, validation fails,\nor reserved parameters are supplied in extra
ApiError \u2013 If the token endpoint returns an error
Example
\nsubject_token=token,\nsubject_token_type=\u201durn:example:subject-token\u201d,\naudience=\u201dhttps://api.backend.com\u201d
\n)
\nReferences
\nCustom Token Exchange: https://auth0.com/docs/authenticate/custom-token-exchange
Related SDK: https://github.com/auth0/auth0-auth-js
Exchange an Auth0 access token for another Auth0 access token targeting a downstream API\nwhile acting on behalf of the same end user (OBO).
\nThis is a convenience wrapper around get_token_by_exchange_profile() that fixes the\nRFC 8693 token types for Auth0 access-token-to-access-token exchange.
\naccess_token \u2013 The Auth0 access token to exchange
audience \u2013 Target API identifier for the exchanged access token
scope \u2013 Optional space-separated OAuth 2.0 scopes to request
verified \u2013 The already-verified token, supplied by a caller that has verified it (for\nexample an MCP server). When omitted and a token_store is configured, the\ntoken is verified here before any cache lookup. Its claims must carry sub\nand iss, otherwise caching is skipped with a warning.
access_token (str): The exchanged Auth0 access token
expires_in (int): Token lifetime in seconds
expires_at (int): Absolute expiration time as a Unix timestamp in seconds, calculated by the SDK from expires_in
scope (str, optional): Granted scopes
token_type (str, optional): Token type (typically \u201cBearer\u201d)
issued_token_type (str, optional): RFC 8693 issued token type identifier
Dictionary containing
\nCaching is enabled only when a token_store is configured on the client. Without a store\nevery call performs a fresh exchange and nothing is cached. The scope_matching option\ncontrols whether a cached token is reused only on an exact scope match (\u201cstrict\u201d) or\nwhenever its granted scopes cover the request (\u201cnon_strict\u201d).
\nMissingRequiredArgumentError \u2013 If required parameters are missing
VerifyAccessTokenError \u2013 If a store is configured and either verified is omitted and the token fails verification, or verified is supplied but does not match the access token being exchanged
MissingOrganizationError \u2013 If a store is configured, verified is omitted, organization_policy is \u201crequired\u201d and the token has no org_id claim
OrganizationNotAllowedError \u2013 If a store is configured, verified is omitted and the token\u2019s org_id is not in the organization_id allowlist
AuthServerUnavailableError \u2013 If a store is configured, verified is omitted and the OIDC discovery document or JWKS cannot be reached
GetTokenByExchangeProfileError \u2013 If client credentials are not configured or validation fails
ApiError \u2013 If the token endpoint returns an error
Obtain a client credentials (M2M) access token for a server-to-server call.
\naudience \u2013 Target API identifier for the access token
scope \u2013 Optional space-separated OAuth 2.0 scopes to request
access_token (str): The access token
expires_in (int): Token lifetime in seconds
expires_at (int): Absolute expiration time as a Unix timestamp in seconds, calculated by the SDK from expires_in
scope (str, optional): Granted scopes, if returned by Auth0
token_type (str, optional): Token type, if returned by Auth0
Dictionary containing
\nMissingRequiredArgumentError \u2013 If audience is not provided
GetClientCredentialsTokenError \u2013 If client credentials are not configured or token endpoint is missing
ApiError \u2013 If the token endpoint returns an error or a malformed response
loggerTOKEN_EXCHANGE_GRANT_TYPEOBO_ACCESS_TOKEN_TYPEMAX_ARRAY_VALUES_PER_KEYRESERVED_PARAMSApiClientApiClient.optionsApiClient.is_dpop_required()ApiClient.verify_request()ApiClient.verify_access_token()ApiClient.verify_dpop_proof()ApiClient.get_access_token_for_connection()ApiClient.get_token_by_exchange_profile()ApiClient.get_token_on_behalf_of()ApiClient.get_client_credentials_token()| \n | Abstract base class for cache implementations. | \n
| \n | Default in-memory cache implementation with LRU eviction. | \n
Bases: abc.ABC
Abstract base class for cache implementations.
\nAllows custom cache backends (Redis, Memcached, etc.) to be plugged into\nthe ApiClient for caching OIDC discovery metadata and JWKS.
\nExample
\nself.redis = redis_client
\nvalue = self.redis.get(key)\nreturn json.loads(value) if value else None
\nself.redis.set(key, json.dumps(value), ex=ttl_seconds)
\nself.redis.delete(key)
\nself.redis.flushdb()
\nGet value from cache by key.
\nkey \u2013 Cache key to retrieve
\nCached value if found and not expired, None otherwise
\nSet value in cache with optional TTL.
\nkey \u2013 Cache key to store
value \u2013 Value to cache
ttl_seconds \u2013 Time-to-live in seconds. None means no expiration.
Delete value from cache.
\nkey \u2013 Cache key to delete
\nClear all cache entries.
\nBases: CacheAdapter
Default in-memory cache implementation with LRU eviction.
\nDesigned for asyncio (single-threaded).\nFor multi-threaded environments, implement a custom CacheAdapter\nwith appropriate locking.
\nFeatures:\n- TTL (time-to-live) support per entry using monotonic clock\n- LRU (Least Recently Used) eviction when max_entries reached\n- No external dependencies
\nmax_entries \u2013 Maximum number of entries to cache. When exceeded,\nleast recently used entry is evicted. Default: 100.
\nExample
\ncache = InMemoryCache(max_entries=50)\ncache.set(\u201ckey1\u201d, {\u201cdata\u201d: \u201cvalue\u201d}, ttl_seconds=600)\nvalue = cache.get(\u201ckey1\u201d) # Returns {\u201cdata\u201d: \u201cvalue\u201d}
\nGet value from cache by key.
\nUpdates access order for LRU tracking.
\nkey \u2013 Cache key to retrieve
\nCached value if found and not expired, None otherwise
\nSet value in cache with optional TTL.
\nIf cache is at max capacity, evicts least recently used entry.
\nkey \u2013 Cache key to store
value \u2013 Value to cache
ttl_seconds \u2013 Time-to-live in seconds. None means no expiration.
Delete value from cache.
\nkey \u2013 Cache key to delete
\nClear all cache entries.
\nConfiguration classes and utilities for auth0-api-python.
\n| \n | Configuration for the ApiClient. | \n
Configuration for the ApiClient.
\ndomain \u2013 The Auth0 domain for single-domain mode and client flows,\ne.g., \u201cmy-tenant.us.auth0.com\u201d. Optional if domains is provided.
domains \u2013 List of allowed domains or a resolver function for multi-domain mode.\nCan be a static list of domain strings or a callable that returns\nallowed domains dynamically. Optional if domain is provided.
audience \u2013 The expected \u2018aud\u2019 claim in the token.
custom_fetch \u2013 Optional callable that replaces the default HTTP fetch for discovery and JWKS requests. It is called with the URL only and receives no telemetry headers.
cache_adapter \u2013 Custom cache implementation. If not provided, uses default InMemoryCache.
token_store \u2013 Custom token storage for token caching. If not provided, caching is disabled and every exchange makes a fresh network call.
cache_ttl_seconds \u2013 Time-to-live for cache entries in seconds (default: 600 = 10 minutes).
cache_max_entries \u2013 Maximum number of cache entries before LRU eviction (default: 100).
dpop_enabled \u2013 Whether DPoP is enabled (default: True for backward compatibility).
dpop_required \u2013 Whether DPoP is required (default: False, allows both Bearer and DPoP).
dpop_iat_leeway \u2013 Leeway in seconds for DPoP proof iat claim (default: 30).
dpop_iat_offset \u2013 Maximum age in seconds for DPoP proof iat claim (default: 300).
client_id \u2013 Required for get_access_token_for_connection, get_token_by_exchange_profile,\nand get_token_on_behalf_of.
client_secret \u2013 Required for get_access_token_for_connection, get_token_by_exchange_profile,\nand get_token_on_behalf_of.
timeout \u2013 HTTP timeout in seconds for token endpoint requests (default: 10.0).
organization_policy \u2013 Whether the incoming token must carry an org_id claim.\n\u201callow\u201d (default) uses org_id when present but does not require it,\nmatching the pre-existing behavior of verify_access_token.\n\u201crequired\u201d rejects any token without an org_id claim.
organization_id \u2013 Optional allowlist of org_id claim values (a non-empty string or a non-empty\nlist of non-empty strings). Only valid when organization_policy is\n\u201crequired\u201d - passing it with \u201callow\u201d raises ConfigurationError at\nconstruction time, as does an empty or non-string value.
scope_matching \u2013 OBO cache scope-matching mode, applied only when token_store is set.\n\u201cstrict\u201d (default) reuses a cached token only on an exact granted-scope\nmatch. \u201cnon_strict\u201d reuses any cached token whose granted scopes cover\nthe request, and requires a token_store subclassing IndexedTokenStore\n(raises ConfigurationError at construction without one).
client_info \u2013 Name, version and optional env of a wrapper SDK built on this one, as a dict with non-empty string \u201cname\u201d and \u201cversion\u201d keys and an optional \u201cenv\u201d dict of string keys and values. Sent in the Auth0-Client header. An invalid value raises ConfigurationError at construction, and the \u201cpython\u201d and \u201cauth0-api-python\u201d entries in env are set by this SDK.
ApiClientOptionsApiClientOptions.domainApiClientOptions.domainsApiClientOptions.audienceApiClientOptions.custom_fetchApiClientOptions.cache_adapterApiClientOptions.token_storeApiClientOptions.cache_ttl_secondsApiClientOptions.cache_max_entriesApiClientOptions.dpop_enabledApiClientOptions.dpop_requiredApiClientOptions.dpop_iat_leewayApiClientOptions.dpop_iat_offsetApiClientOptions.client_idApiClientOptions.client_secretApiClientOptions.timeoutApiClientOptions.organization_policyApiClientOptions.organization_idApiClientOptions.scope_matchingApiClientOptions.client_infoJWE encryption helpers for token store implementations.
\n
| \nEncrypt a dict to a compact JWE string. A fresh random kid is generated per call. | \n
| \nDecrypt a compact JWE string back to a dict. | \n
Encrypt a dict to a compact JWE string. A fresh random kid is generated per call.
\nDecrypt a compact JWE string back to a dict.
\nCustom exceptions for auth0-api-python SDK with HTTP response metadata
\n| \n | Base class for all auth errors with HTTP response metadata. | \n
| \n | Error raised when a required argument is missing. | \n
| \n | Error raised when verifying the access token fails. | \n
| \n | Error raised when the OIDC discovery document or JWKS cannot be reached. | \n
| \n | Error raised when organization_policy is 'required' but the token has no org_id claim. | \n
| \n | Error raised when the token's org_id claim is not in the organization_id allowlist. | \n
| \n | Error raised when the provided authentication scheme is unsupported. | \n
| \n | Error raised when validating a DPoP proof fails. | \n
| \n | Authorization header is missing, empty, or malformed. | \n
| \n | Error raised when getting a token for a connection fails. | \n
| \n | Error raised when getting a token via exchange profile fails. | \n
| \n | Error raised when a client credentials token request fails before the network call. | \n
| \n | Error raised when an API request to Auth0 fails. | \n
| \n | Error raised when SDK configuration is invalid. | \n
| \n | Error raised when domains resolver function fails. | \n
Bases: Exception
Base class for all auth errors with HTTP response metadata.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nReturn the error description.
\nReturn HTTP headers (including WWW-Authenticate if set).
\nBases: BaseAuthError
Error raised when a required argument is missing.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when verifying the access token fails.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: VerifyAccessTokenError
Error raised when the OIDC discovery document or JWKS cannot be reached.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: VerifyAccessTokenError
Error raised when organization_policy is \u2018required\u2019 but the token has no org_id claim.
\nBases: VerifyAccessTokenError
Error raised when the token\u2019s org_id claim is not in the organization_id allowlist.
\nBases: BaseAuthError
Error raised when the provided authentication scheme is unsupported.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when validating a DPoP proof fails.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Authorization header is missing, empty, or malformed.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when getting a token for a connection fails.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when getting a token via exchange profile fails.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when a client credentials token request fails before the network call.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when an API request to Auth0 fails.\nContains details about the original error from Auth0.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when SDK configuration is invalid.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBases: BaseAuthError
Error raised when domains resolver function fails.
\nReturn the HTTP status code for this error.
\nReturn the OAuth/DPoP error code.
\nBaseAuthError\nMissingRequiredArgumentError\nVerifyAccessTokenError\nAuthServerUnavailableError\nMissingOrganizationErrorOrganizationNotAllowedErrorInvalidAuthSchemeError\nInvalidDpopProofError\nMissingAuthorizationError\nGetAccessTokenForConnectionError\nGetTokenByExchangeProfileError\nGetClientCredentialsTokenError\nApiError\nConfigurationError\nDomainsResolverError\nauth0-api-python
\nA lightweight Python SDK for verifying Auth0-issued access tokens\nin server-side APIs, using Authlib for OIDC discovery and JWKS fetching.
\nClient telemetry headers sent on requests this SDK makes to Auth0 with its default HTTP client.
\n
| \nCheck the shape of a wrapper's client_info. | \n
| \nBuild the Auth0-Client and User-Agent headers. | \n
Check the shape of a wrapper\u2019s client_info.
\nValueError \u2013 If client_info is not a dict with non-empty string name and version, and an optional env dict of strings.
\nBuild the Auth0-Client and User-Agent headers.
\nclient_info \u2013 Name, version and optional env of a wrapper SDK built on this one.
\nHeaders to attach to each HTTP request.
\nToken storage for SDK-minted tokens (OBO, M2M, Token Vault), distinct from CacheAdapter.
\n| \n | A minted access token and its absolute expiration, as stored by a TokenStore. | \n
| \n | Access token with verified claims from verify_access_token, trusted to build the cache key. | \n
| \n | Base class for external token stores with built-in JWE encrypt and decrypt helpers. | \n
| \n | One cached token listed in an index, with the scopes it was granted and when it expires. | \n
| \n | Token store variant that maintains a scope index with atomic member writes to avoid concurrent-add races. | \n
Bases: _TokenSetRequired
A minted access token and its absolute expiration, as stored by a TokenStore.
\nAccess token with verified claims from verify_access_token, trusted to build the cache key.
\nBases: abc.ABC
Base class for external token stores with built-in JWE encrypt and decrypt helpers.
\nReturn the stored token or None if absent.
\nDelete a stored token by key.
\nBases: TypedDict
One cached token listed in an index, with the scopes it was granted and when it expires.
\nBases: AbstractTokenStore
Token store variant that maintains a scope index with atomic member writes to avoid concurrent-add races.
\nAtomically add member to the index, replacing any member with the same token_key.
\nReturn the index members, possibly including expired ones, or [] if the index is absent.
\nTokenSet\nVerifiedToken\nAbstractTokenStore\nTokenIndexMember\nIndexedTokenStore\n| \n | \n |
| \n | \n |
| \nGenerates a real RS256-signed JWT using the private key above. | \n
| \nGenerates a real ES256-signed DPoP proof JWT using the EC private key above. | \n
| \nGenerates an access token with cnf (confirmation) claim for DPoP binding. | \n
Generates a real RS256-signed JWT using the private key above.
\ndomain \u2013 The Auth0 domain (used if issuer is not False).
user_id \u2013 The \u2018sub\u2019 claim in the token.
audience \u2013 The \u2018aud\u2019 claim in the token. If omitted, \u2018aud\u2019 won\u2019t be included.
issuer \u2013
If a string, it\u2019s placed in \u2018iss\u2019 claim.
If None, default is f\u201dhttps://{domain}/\u201d.
If False, skip \u2018iss\u2019 claim entirely.
iat \u2013 Whether to set the \u2018iat\u2019 (issued at) claim. If False, skip it.
exp \u2013 Whether to set the \u2018exp\u2019 claim. If False, skip it.
claims \u2013 Additional custom claims to merge into the token.
expiration_time \u2013 If exp is True, how many seconds from now until expiration.
A RS256-signed JWT string.
\ndomain=\u201dexample.us.auth0.com\u201d,\nuser_id=\u201duser123\u201d,\naudience=\u201dmy-api\u201d,\nissuer=False,\niat=False,\nexp=False,\nclaims={\u201cscope\u201d: \u201cread:stuff\u201d}
\n)
\nGenerates a real ES256-signed DPoP proof JWT using the EC private key above.
\naccess_token \u2013 The access token to create proof for (used for ath claim).
http_method \u2013 The HTTP method (e.g., \u201cGET\u201d, \u201cPOST\u201d) for htm claim.
http_url \u2013 The HTTP URL for htu claim.
jti \u2013 The unique identifier for the proof. If omitted, generates random UUID.
iat \u2013 Whether to set the \u2018iat\u2019 (issued at) claim. If False, skip it.
claims \u2013 Additional custom claims to merge into the proof.
header_overrides \u2013 Override header parameters (e.g., for testing invalid headers).
iat_time \u2013 Fixed time for iat claim (for testing). If None, uses current time.
include_jti \u2013 Whether to include the \u2018jti\u2019 claim. If False, jti is completely omitted.
An ES256-signed DPoP proof JWT string.
\naccess_token=\u201deyJ\u2026\u201d,\nhttp_method=\u201dGET\u201d,\nhttp_url=\u201dhttps://api.example.com/resource\u201d,\niat=False, # Skip iat for testing\nclaims={\u201ccustom\u201d: \u201cclaim\u201d}
\n)
\nGenerates an access token with cnf (confirmation) claim for DPoP binding.\nExtends the existing generate_token() function with DPoP support.
\ndomain \u2013 The Auth0 domain (used if issuer is not False).
user_id \u2013 The \u2018sub\u2019 claim in the token.
audience \u2013 The \u2018aud\u2019 claim in the token.
jkt_thumbprint \u2013 JWK thumbprint to include in cnf claim. If None, calculates from PRIVATE_EC_JWK.
**kwargs \u2013 Additional arguments passed to generate_token().
A RS256-signed JWT string with cnf claim.
\ndomain=\u201dauth0.local\u201d,\nuser_id=\u201duser123\u201d,\naudience=\u201dmy-api\u201d,\njkt_thumbprint=\u201dcustom_thumbprint\u201d
\n)
\nType definitions for auth0-api-python SDK
\n| \n | Type alias for domains resolver function. | \n
| \n | Actor claim carried by access tokens issued through delegation. | \n
| \n | Context passed to domains resolver functions. | \n
| \n | Result returned from an On Behalf Of token exchange. | \n
| \n | Result returned from a client credentials (M2M) token request. | \n
Bases: TypedDict
Actor claim carried by access tokens issued through delegation.
\nThe current actor for this step of the delegation chain.
\nThe prior actor in the delegation chain, if present.
\nBases: TypedDict
Context passed to domains resolver functions.
\nThe URL the API request was made to (optional)
\nRequest headers dict (e.g., Host, X-Forwarded-Host) (optional)
\nThe issuer claim from the unverified token
\nBases: TypedDict
Result returned from an On Behalf Of token exchange.
\nThe access token issued for the downstream API.
\nToken lifetime in seconds.
\nAbsolute expiration time as a Unix timestamp in seconds, calculated by the SDK from expires_in.
\nGranted scopes, if returned by Auth0.
\nToken type, if returned by Auth0.
\nRFC 8693 issued token type, if returned by Auth0.
\nBases: TypedDict
Result returned from a client credentials (M2M) token request.
\nThe access token issued for the target API.
\nToken lifetime in seconds.
\nAbsolute expiration time as a Unix timestamp in seconds, calculated by the SDK from expires_in.
\nGranted scopes, if returned by Auth0.
\nToken type, if returned by Auth0.
\nType alias for domains resolver function.
\nA DomainsResolver is a sync or async function that receives a DomainsResolverContext\nand returns a list of allowed domain strings.
\ncontext (DomainsResolverContext) \u2013 Dictionary containing:\n- \u2018request_url\u2019 (str | None): The URL the API request was made to\n- \u2018request_headers\u2019 (dict | None): Request headers (e.g., Host, X-Forwarded-Host)\n- \u2018unverified_iss\u2019 (str): The issuer claim from the unverified token
\nList of allowed domain strings (e.g., [\u2018tenant.auth0.com\u2019])
\nlist[str]
\nfrom auth0_api_python import DomainsResolverContext
\nhost = (context.get(\u2018request_headers\u2019) or {}).get(\u2018host\u2019)\nif host == \u2018api.brand.com\u2019:
\n\n\nreturn [\u2018brand.custom-domain.com\u2019]
\n
return [\u2018tenant.auth0.com\u2019]
\ndomains = await db.lookup_domains(context[\u2018unverified_iss\u2019])\nreturn domains
\nActClaim\nDomainsResolverContext\nOnBehalfOfTokenResultOnBehalfOfTokenResult.access_tokenOnBehalfOfTokenResult.expires_inOnBehalfOfTokenResult.expires_atOnBehalfOfTokenResult.scopeOnBehalfOfTokenResult.token_typeOnBehalfOfTokenResult.issued_token_typeOnBehalfOfTokenResult.access_tokenOnBehalfOfTokenResult.expires_inOnBehalfOfTokenResult.expires_atOnBehalfOfTokenResult.scopeOnBehalfOfTokenResult.token_typeOnBehalfOfTokenResult.issued_token_typeClientCredentialsTokenResultClientCredentialsTokenResult.access_tokenClientCredentialsTokenResult.expires_inClientCredentialsTokenResult.expires_atClientCredentialsTokenResult.scopeClientCredentialsTokenResult.token_typeClientCredentialsTokenResult.access_tokenClientCredentialsTokenResult.expires_inClientCredentialsTokenResult.expires_atClientCredentialsTokenResult.scopeClientCredentialsTokenResult.token_typeDomainsResolverUtility functions for OIDC discovery and JWKS fetching (asynchronously)\nusing httpx or a custom fetch approach.
\n
| \nParse the max-age directive from a Cache-Control HTTP header. | \n
| \nNormalize a domain string to a standard issuer URL format. | \n
| \nCheck whether a discovery or JWKS fetch error means the auth server is down or overloaded. | \n
| \nAsynchronously fetch the OIDC config from https://{domain}/.well-known/openid-configuration. | \n
| \nAsynchronously fetch the JSON Web Key Set from jwks_uri. | \n
| \nParse the JWT header without verifying signature. | \n
| \nParse the JWT payload without verifying signature. | \n
| \nIf segment's length is not a multiple of 4, add '=' padding | \n
| \nIf the string looks like b'eyJh...', remove the leading b' and trailing '. | \n
| \nNormalize URL for DPoP htu comparison . | \n
| \nCompute SHA-256 digest of the input string and return a | \n
| \nCompute the RFC 7638 JWK thumbprint for a public JWK. | \n
Parse the max-age directive from a Cache-Control HTTP header.
\nheaders \u2013 HTTP response headers (dict-like, supports case-insensitive\naccess for httpx Headers objects)
\nmax-age value in seconds, or None if not present or unparseable
\nNormalize a domain string to a standard issuer URL format.
\ndomain \u2013 Domain string in any format (e.g., \u201ctenant.auth0.com\u201d,\n\u201chttps://tenant.auth0.com/\u201d, \u201cTENANT.AUTH0.COM\u201d)
\n//tenant.auth0.com/\u201d)
\nNormalized issuer URL (e.g., \u201chttps
\nCheck whether a discovery or JWKS fetch error means the auth server is down or overloaded.
\nerror \u2013 The exception raised while fetching.
\nTrue for connection errors, timeouts, HTTP 5xx and HTTP 429. False for anything else.
\nAsynchronously fetch the OIDC config from https://{domain}/.well-known/openid-configuration.
\ndomain \u2013 The Auth0 domain.
custom_fetch \u2013 Optional callable that replaces the default HTTP fetch.
headers \u2013 Headers for the default HTTP client. Not applied when custom_fetch is set.
Tuple of (metadata_dict, max_age_or_none). max_age is parsed from\nthe Cache-Control response header if present.
\nAsynchronously fetch the JSON Web Key Set from jwks_uri.
\njwks_uri \u2013 The JWKS endpoint URL.
custom_fetch \u2013 Optional callable that replaces the default HTTP fetch.
headers \u2013 Headers for the default HTTP client. Not applied when custom_fetch is set.
Tuple of (jwks_dict, max_age_or_none). max_age is parsed from\nthe Cache-Control response header if present.
\nParse the JWT header without verifying signature.
\ntoken \u2013 The JWT token
\nDecoded header as dictionary
\nValueError \u2013 If the token is malformed or its header is not a JSON object or is nested too deeply
\nParse the JWT payload without verifying signature.
\ntoken \u2013 The JWT token
\nDecoded payload (claims) as dictionary
\nValueError \u2013 If the token is malformed or its payload is not a JSON object or is nested too deeply
\nIf segment\u2019s length is not a multiple of 4, add \u2018=\u2019 padding\nso that base64.urlsafe_b64decode won\u2019t produce nonsense bytes.\nNo extra \u2018=\u2019 added if length is already a multiple of 4.
\nIf the string looks like b\u2019eyJh\u2026\u2019, remove the leading b\u2019 and trailing \u2018.
\nNormalize URL for DPoP htu comparison .
\nraw_url \u2013 The raw URL string to normalize
\nThe normalized URL string
\nValueError \u2013 If the URL is invalid or cannot be parsed
\nCompute SHA-256 digest of the input string and return a\nBase64URL-encoded string without padding.
\nCompute the RFC 7638 JWK thumbprint for a public JWK.
\nFor EC keys, includes only: crv, kty, x, y
Serializes with no whitespace, keys sorted lexicographically
Hashes with SHA-256 and returns base64url-encoded string without padding
This page contains auto-generated API reference documentation [1].
\n