Python Flask authentication starter for Tuurio ID with server-side sessions and OpenID Connect Authorization Code flow.
Generated from
Tuurio/auth_samples/auth_samples_python. Submit implementation fixes upstream so they are not replaced by the next synchronized release.
- Standards-based OpenID Connect authentication with framework-native integration.
- Exact redirect and post-logout redirect handling.
- Protected-route and logout examples.
- A reviewed, pinned Tuurio provisioning workflow.
- Create a repository with Use this template or clone this repository.
- Follow the framework-specific prerequisites below.
- Review and run this pinned provisioning command:
npx manage-tuurio-id@1.1.6 init --framework python --project-dir . --auth browser --yes --output json --campaign github_flask --no-open --no-wait- Approve the exact command, then complete the secure browser handoff yourself.
- Run the build and verify one real sign-in and sign-out.
Never paste credentials, client secrets, authorization codes, tokens, session cookies, or environment-file contents into an agent chat. Browser and native applications are public clients and must not contain a client secret.
- Runtime: Python 3.11+
- Package manager: pip
- Verification:
python3 -m pip install -r requirements.txt && python3 -m compileall -q .
This starter uses OpenID Connect Authorization Code flow. Browser and native clients use PKCE S256 and contain no client secret. Redirect and post-logout redirect URIs must match exactly. Identity comes from the established OIDC integration or an authenticated UserInfo request; decoded JWT payloads are never treated as validation. Keep generated local environment files ignored and never commit tokens or credentials.
A server-rendered Flask demo that signs in with OAuth 2.0 / OpenID Connect, keeps tokens in a server-side session, and supports logout. The local starter uses a filesystem-backed CacheLib session store; use Redis or another shared Flask-Session backend for a multi-instance production deployment.
- Detailed integration guide: Python example page
- General developer docs: Tuurio ID developers
cd auth_samples_python
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
# edit .env with your tenant/client values
python app.pyOpen http://localhost:8083.
Configure your Tuurio client with these redirect URLs (matching your .env values):
Redirect URI: http://localhost:8083/auth/callback
Post-logout Redirect URI: http://localhost:8083/logout/callback
TUURIO_ISSUER=https://YOUR_TENANT.id.tuurio.com
TUURIO_CLIENT_ID=YOUR_CLIENT_ID
TUURIO_CLIENT_SECRET=YOUR_CLIENT_SECRET
TUURIO_REDIRECT_URI=http://localhost:8083/auth/callback
TUURIO_POST_LOGOUT_REDIRECT_URI=http://localhost:8083/logout/callback
TUURIO_SCOPE=openid profile email
TUURIO_SESSION_SECRET=tuurio-auth-sampleValues come from your Tuurio Connect page:
https://<tenantId>.id.tuurio.com/admin/clients
Licensed under the Apache License, Version 2.0. See LICENSE.