Alpha on PyPI

Authentication, inside your FastAPI app.

Install the library, mount the routers, and keep every user, role, and audit event in your Postgres. Start with simple RBAC and grow into org-aware authorization without moving your identity layer.

Start building Explore on GitHub

main.pyFastAPI

from outlabs_auth import SimpleRBAC

auth = SimpleRBAC(
    database_url=DATABASE_URL,
    secret_key=SECRET_KEY,
)

auth.prime_fastapi_routing()
app.include_router(
    get_auth_router(auth, prefix="/auth")
)

Mounted

/auth/*

Your database

PostgreSQL

Protected

Typed dependencies

Built for the Python stack you already operate

Own the control plane

Your auth should feel like part of your product

OutlabsAuth runs inside the boundary you already trust. There is no second tenant to reconcile, no remote policy engine in the request path, and no user export waiting in your future.

Mounted in your app
Choose the router prefix and expose only the auth surfaces your product needs.
Stored in your Postgres
Users, sessions, roles, entities, and audit events stay in infrastructure you operate.
Enforced in Python
Typed FastAPI dependencies keep authorization beside the code they protect.

One core, two authorization models

Start simple. Keep the headroom.

Choose the model that matches your product today. Both presets share the same authentication, invitation, API key, and dependency patterns.

The focused default

SimpleRBAC

Flat roles and permissions for SaaS products, internal tools, and applications without hierarchy-scoped access.

RolesPermissionsFastAPI deps

For hierarchical products

EnterpriseRBAC

Entity trees, memberships, context-aware roles, tree permissions, and optional ABAC when the org chart is the permission model.

Entity treesMembershipsABAC

A complete auth surface

Mount the capabilities your product needs

Every surface is available through composable router factories, so you can start small and add features without changing the foundation.

JWTs & sessions

Access and refresh tokens, optional rotation, and session management for account-security screens.

OAuth & social login

Provider login and account linking through routers you opt into and configure.

Invites & passwordless

Email invites, magic links, and phone codes while you keep control of message delivery.

API keys

Personal and system-integration keys with host-friendly hashing and management APIs.

Audit & activity

Searchable events plus optional DAU and MAU-style activity tracking for product operations.

Observable by default

Prometheus metrics and structured logs that join the tooling your FastAPI service already uses.

Optional operator UI

See the system before you build the admin screens

OutlabsAuth UI connects to any mounted host and adapts to the routers it exposes. Use it as your operator console or as a working reference for a UI of your own.

Explore OutlabsAuth UI

Operator console

Connected to /auth/config

Live

1,284

Users

Roles

Entities

326

Active sessions

Documentation

Take the shortest path to working auth

The handbook is organized around the decisions and implementation steps you will make first.

Install in one sitting

Package, migrations, configuration, and your first mounted auth router.

Pick the right preset

Choose flat RBAC or hierarchical authorization without guessing at the trade-offs.

Mount only what you need

Explore every router, prefix, and HTTP surface available to your application.

Protect host routes

Use the current authentication, permission, entity, tree, and two-phase dependency APIs.

Operate without a UI

Administer users, policy, credentials, sessions, and audit from a terminal or coding agent.

Put auth inside your app

Install the alpha from PyPI, mount your first router, and keep control of the system from day one.

Read the quickstart View on PyPI