armasec-lite

Injectable FastAPI auth via OIDC, with three dependencies instead of ten.

armasec-lite validates bearer tokens against your identity provider's JWKS, checks scopes and issuer/audience claims, and guards a route with a single Depends(). It is a dependency-minimal reimplementation of armasec 3.x with the same public API, built almost entirely on the standard library. Runtime dependencies are fastapi, cryptography and pydantic.

Install

uv add armasec-lite

The pytest fixtures, including the mock OIDC provider, live behind an extra:

uv add "armasec-lite[test]"

Usage

"""Secure a single route against one OIDC domain."""

import os

from armasec_lite import Armasec
from fastapi import Depends, FastAPI

app = FastAPI()
armasec = Armasec(
    domain=os.environ.get("ARMASEC_DOMAIN"),
    audience=os.environ.get("ARMASEC_AUDIENCE"),
)


@app.get("/stuff", dependencies=[Depends(armasec.lockdown("read:stuff"))])
async def check_access():
    return {"message": "Successfully authenticated!"}

Runnable variants, including multiple domains, match_keys, permission extractors and the plugin system, are in examples/.

Documentation

docs.vantagecompute.ai/developer/armasec-lite

• Installation
• Quickstart
• Migrating from armasec covers every behavior difference from upstream 3.x, and what each one requires of you.
• Security covers the JWT verification order, the threat model, and what the attack suite defends.
• Architecture covers the request lifecycle, the caching model and the threading model.
• API Reference

License

MIT. See LICENSE.