Storage-agnostic authentication, authorization, account lifecycle, and WebSocket security for Litestar.
Litestar Security connects local accounts, external identity providers, API keys, and workload JWTs to Litestar’s middleware, dependency injection, authorization guards, OpenAPI schema, and WebSocket lifecycle without coupling your application to an ORM, database driver, or cache SDK.
Install the core package with only the optional extras your deployment uses and mount SecurityPlugin in minutes.
Compile route policies at startup and enforce roles, scopes, tenant memberships, capabilities, and fresh step-up assurance.
Run browser sessions, rotating refresh-token families, or hybrid profiles with TOTP, recovery codes, WebAuthn passkeys, and step-up grants.
Verify OAuth 2.0 and OIDC callbacks, Google Cloud IAP assertions, workload JWTs backed by bounded JWKS caches, and prefixed API keys.
Issue policy-bound connect tokens, supervise open socket expiry and revocation, and publish RFC 9728 protected-resource metadata.
Implement narrow persistence protocols against any database or cache and validate adapters with assert_security_backend_conformance.