Server Config

CookieConfig

from authfort import CookieConfig

from authfort import CookieConfig

Field	Type	Default	Description
`secure`	`bool`	`True`	HTTPS only
`httponly`	`bool`	`True`	No JavaScript access
`samesite`	`Literal["lax", "strict", "none"]`	`"lax"`	SameSite policy
`path`	`str`	`"/"`	Cookie path
`domain`	`str \| None`	`None`	Cookie domain (e.g., `".example.com"` for subdomains)
`access_cookie_name`	`str`	`"access_token"`	Access token cookie name
`refresh_cookie_name`	`str`	`"refresh_token"`	Refresh token cookie name

Examples

# Default — HTTPS, HttpOnly, Lax
cookie = CookieConfig()

# Local development
cookie = CookieConfig(secure=False)

# Subdomain sharing
cookie = CookieConfig(domain=".example.com")

# Strict same-site (no cross-origin)
cookie = CookieConfig(samesite="strict")

# Cross-origin (requires secure=True)
cookie = CookieConfig(samesite="none")

# Default — HTTPS, HttpOnly, Lax
cookie = CookieConfig()

# Local development
cookie = CookieConfig(secure=False)

# Subdomain sharing
cookie = CookieConfig(domain=".example.com")

# Strict same-site (no cross-origin)
cookie = CookieConfig(samesite="strict")

# Cross-origin (requires secure=True)
cookie = CookieConfig(samesite="none")

GoogleProvider

from authfort import GoogleProvider

from authfort import GoogleProvider

Field	Type	Default	Description
`client_id`	`str`	— (required)	Google OAuth client ID
`client_secret`	`str`	— (required)	Google OAuth client secret
`extra_scopes`	`tuple[str, ...]`	`()`	Additional OAuth scopes beyond required ones

REQUIRED_SCOPES: ("openid", "email", "profile") — always included automatically.

Properties

Property	Value
`name`	`"google"`
`authorize_url`	`"https://accounts.google.com/o/oauth2/v2/auth"`
`token_url`	`"https://oauth2.googleapis.com/token"`

GitHubProvider

from authfort import GitHubProvider

from authfort import GitHubProvider

Field	Type	Default	Description
`client_id`	`str`	— (required)	GitHub OAuth client ID
`client_secret`	`str`	— (required)	GitHub OAuth client secret
`extra_scopes`	`tuple[str, ...]`	`()`	Additional OAuth scopes beyond required ones

REQUIRED_SCOPES: ("read:user", "user:email") — always included automatically.

Properties

Property	Value
`name`	`"github"`
`authorize_url`	`"https://github.com/login/oauth/authorize"`
`token_url`	`"https://github.com/login/oauth/access_token"`

GenericOAuthProvider

from authfort import GenericOAuthProvider

Field	Type	Default	Description
`name`	`str`	— (required, positional)	Provider name
`client_id`	`str`	— (required)	OAuth client ID
`client_secret`	`str`	— (required)	OAuth client secret
`authorize_url`	`str`	— (required)	Authorization endpoint URL
`token_url`	`str`	— (required)	Token endpoint URL
`userinfo_url`	`str`	— (required)	Userinfo endpoint URL
`scopes`	`tuple[str, ...]`	`()`	OAuth scopes
`extra_scopes`	`tuple[str, ...]`	`()`	Additional OAuth scopes
`map_user_info`	`callable \| None`	`None`	Custom function to map userinfo response
`redirect_uri`	`str \| None`	`None`	Custom redirect URI

GenericOIDCProvider

from authfort import GenericOIDCProvider

Field	Type	Default	Description
`name`	`str`	— (required, positional)	Provider name
`client_id`	`str`	— (required)	OAuth client ID
`client_secret`	`str`	— (required)	OAuth client secret
`discovery_url`	`str`	— (required)	OpenID Connect discovery URL
`scopes`	`tuple[str, ...]`	`("openid", "email", "profile")`	OAuth scopes
`extra_scopes`	`tuple[str, ...]`	`()`	Additional OAuth scopes
`map_user_info`	`callable \| None`	`None`	Custom function to map userinfo response
`discovery_ttl`	`float`	`3600`	Discovery document cache TTL in seconds
`redirect_uri`	`str \| None`	`None`	Custom redirect URI

Endpoints are auto-discovered from the .well-known/openid-configuration URL.

RateLimitConfig

from authfort import RateLimitConfig

Per-endpoint rate limits. Pass to AuthFort(rate_limit=...) to enable rate limiting. Set individual fields to None to skip rate limiting for that endpoint.

Field	Type	Default	Description
`login`	`str \| None`	`"5/min"`	Login endpoint
`signup`	`str \| None`	`"3/min"`	Signup endpoint
`magic_link`	`str \| None`	`"5/min"`	Magic link request endpoint
`otp`	`str \| None`	`"5/min"`	OTP request and verify endpoints
`verify_email`	`str \| None`	`"5/min"`	Email verification endpoint
`refresh`	`str \| None`	`"30/min"`	Token refresh endpoint
`oauth_authorize`	`str \| None`	`"10/min"`	OAuth authorization endpoint
`mfa_verify`	`str \| None`	`"5/min"`	MFA verification endpoint (`/auth/mfa/verify`)

Format: "{count}/{period}" where period is sec, min, hour, or day.

Examples

# All defaults
auth = AuthFort(database_url="...", rate_limit=RateLimitConfig())

# Override specific endpoints
auth = AuthFort(
    database_url="...",
    rate_limit=RateLimitConfig(login="10/min", signup="5/min"),
)

# Disable rate limiting for refresh
auth = AuthFort(
    database_url="...",
    rate_limit=RateLimitConfig(refresh=None),
)

RateLimitStore Protocol

from authfort.ratelimit import RateLimitStore

Protocol for custom rate limit storage backends (e.g., Redis). The default is InMemoryStore (sliding window counter, thread-safe).

Method	Signature	Description
`hit`	`hit(key, limit) -> (allowed, remaining, retry_after)`	Record a hit and check if limit exceeded
`reset`	`reset(key=None) -> None`	Reset state for a key, or all keys if `None`

AuthFortConfig

Internal configuration object, accessible via auth.config. Read-only.

Field	Type	Description
`database_url`	`str`	Database connection string
`access_token_expire_seconds`	`int`	Access token TTL
`refresh_token_expire_seconds`	`int`	Refresh token TTL
`jwt_issuer`	`str`	JWT issuer claim
`cookie`	`CookieConfig \| None`	Cookie config
`key_rotation_ttl_seconds`	`int`	Key rotation interval
`introspect_secret`	`str \| None`	Introspection secret
`allow_signup`	`bool`	Public signup enabled
`password_reset_ttl_seconds`	`int`	Reset token TTL
`rsa_key_size`	`int`	RSA key size in bits (default 2048)
`frontend_url`	`str \| None`	Frontend origin for cross-origin OAuth redirects
`email_verify_ttl_seconds`	`int`	Email verification token TTL
`magic_link_ttl_seconds`	`int`	Magic link token TTL
`email_otp_ttl_seconds`	`int`	Email OTP code TTL
`allow_passwordless_signup`	`bool`	Auto-create users via magic link/OTP
`rate_limit`	`RateLimitConfig \| None`	Rate limiting config (None = disabled)
`mfa_issuer`	`str \| None`	App name shown in authenticator apps (defaults to `jwt_issuer`)
`mfa_backup_code_count`	`int`	Number of backup codes generated per user (default 10)