Supported features and platforms¶
OAuth 1.0a is fully supported for both clients and providers.
All standard signature methods defined in RFC 5849 The OAuth 1.0 Protocol are supported:
Non-standard signature methods that replaces SHA-1 with stronger digest algorithms are also supported:
The OAuth 1.0a signature can be placed in the header, URL or body of the request.
OAuth 2.0 client and provider support for:
- RFC 6749 section-4.1: Authorization Code Grant
- RFC 6749 section-4.2: Implicit Grant
- RFC 6749 section-4.3: Resource Owner Password Credentials Grant
- RFC 6749 section-4.4: Client Credentials Grant
- RFC 6749 section-6: Refresh Tokens
- RFC 6750: Bearer Tokens
- RFC 7009: Token Revocation
- RFC Draft Message Authentication Code (MAC) Tokens
- OAuth2.0 Provider: OpenID Connect Core
- OAuth2.0 Provider: RFC 7636: Proof Key for Code Exchange by OAuth Public Clients (PKCE)
- OAuth2.0 Provider: RFC 7662: Token Introspection
- OAuth2.0 Provider: RFC 8414: Authorization Server Metadata
Features to be implemented (any help/PR are welcomed):
- OAuth2.0 Client: OpenID Connect Core
- OAuth2.0 Client: RFC 7636: Proof Key for Code Exchange by OAuth Public Clients (PKCE)
- OAuth2.0 Client: RFC 7662: Token Introspection
- OAuth2.0 Client: RFC 8414: Authorization Server Metadata
- Bearer JWT as Client Authentication
- Dynamic client registration
- OpenID Discovery
- OpenID Session Management
- …and more
OAuthLib is mainly developed and tested on 64-bit Linux. It works on Unix and Unix-like operating systems (including macOS), as well as Microsoft Windows.
It should work on any platform that supports Python, if features requiring RSA public-key cryptography is not used.
If features requiring RSA public-key cryptography is used (e.g RSA-SHA1 and RS256), it should work on any platform supported by PyCA’s cryptography package. RSA features require installing additional packages: see the installation instructions for details.