OAuth 2.1 Guide
Agent skill:
nitrostack-python-auth-security
Use the python-oauth template and its OAUTH_SETUP.md for the full env matrix (JWKS vs introspection, resource metadata, scopes).
Module
Python
from nitrostack import OAuthModule, module, OAuthGuard, use_guards, generate_www_authenticate_header
@module(name="app", imports=[OAuthModule.for_root()])
class AppModule:
pass
OAuthService introspects access tokens into context.auth. aud is a list. Scope helpers: has_scope, has_any_scope, has_all_scopes, require_scopes.
PKCE and CIMD
- PKCE:
generate_code_verifier,generate_code_challenge,generate_pkce_params,verify_pkce,is_valid_code_verifier,validate_pkce_support - Client ID metadata:
resolve_cimd,validate_client_identifier_url,is_blocked_ip - Issuer check:
validate_authorization_iss
Production vs Studio
Unset OAUTH_REQUIRED allows no-token through OAuthGuard (convenient for Studio mocks). Set it in production. Do not enable OAuth in Inspector against the starter/pizzaz templates — Inspector will POST /register and fail.