Blog

In today’s security‑first landscape, relying on a single password is no longer enough. Multi‑factor authentication (MFA) adds an extra layer of protection by requiring users to prove their identity with something they know, something they have, or something they are. If you’re a Python developer, setting up MFA can be straightforward and highly customizable, whether you’re building a Django web app, a Flask API, or a simple command‑line tool. This guide walks you through the core concepts, popular libraries, and step‑by‑step implementation strategies you need to secure your Python projects with MFA.

Why MFA Matters for Python Applications

Implementing MFA reduces the risk of credential stuffing, phishing, and brute‑force attacks. By demanding a second factor—typically a time‑based one‑time password (TOTP) or a push notification—you dramatically lower the chance that a compromised password alone can grant unauthorized access. For Python developers, MFA also offers:

• Compliance readiness: Meet GDPR, HIPAA, and PCI DSS requirements that mandate strong authentication.
• Improved user trust: Users feel safer knowing their accounts are protected beyond just a password.
• Flexibility: Python’s rich ecosystem lets you integrate MFA with web frameworks, REST APIs, and even desktop applications.

Core MFA Methods You Can Implement in Python

1. Time‑Based One‑Time Passwords (TOTP)

TOTP generates a short numeric code that changes every 30 seconds. It’s the method behind Google Authenticator, Authy, and Microsoft Authenticator. The algorithm is defined in RFC 6238 and can be implemented in Python using the pyotp library.

2. HMAC‑Based One‑Time Passwords (HOTP)

HOTP relies on a counter rather than time, making it useful for hardware tokens or environments where clocks may drift. It’s defined in RFC 4226 and also supported by pyotp.

3. Push‑Based Authentication

Push notifications send a “Approve or Deny” prompt to a mobile app (e.g., Duo, Authy). While this requires a third‑party service, Python SDKs make integration painless.

4. Email or SMS OTP

Sending a short code via email or SMS is a common fallback. Services like Twilio, SendGrid, or AWS SNS provide Python clients to dispatch these codes securely.

Choosing the Right Python MFA Library

Below is a quick comparison of the most popular libraries, helping you decide which fits your project best.

• pyotp – Simple, pure‑Python implementation for TOTP/HOTP. No external dependencies.
• django-otp – Extends Django’s authentication system with OTP support, integrates with django-two-factor-auth for a full‑featured UI.
• Flask‑User – Offers optional 2FA for Flask apps, built on top of pyotp.
• python-digital‑ocean‑2fa – Specialized for DigitalOcean’s API, useful for DevOps scripts.
• duo_client – Official Duo Security SDK for push‑based MFA.

Step‑by‑Step: Adding TOTP MFA to a Flask Application

Prerequisites

• Python 3.8+ installed
• Flask 2.x
• Virtual environment (recommended)
• Basic user model with a password hash

1. Install Required Packages

pip install Flask pyotp qrcode[pil] pillow

2. Extend Your User Model

Add two new fields: mfa_secret to store the base32‑encoded secret, and mfa_enabled to toggle MFA per user.

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(150), unique=True, nullable=False)
    password_hash = db.Column(db.String(255), nullable=False)
    mfa_secret = db.Column(db.String(32), nullable=True)
    mfa_enabled = db.Column(db.Boolean, default=False)

3. Generate a Secret and QR Code

When a user opts into MFA, generate a secret and present a QR code that can be scanned by an authenticator app.

import pyotp, qrcode, io
from flask import send_file

def enable_mfa(user):
    # Create a new secret if one doesn’t exist
    if not user.mfa_secret:
        user.mfa_secret = pyotp.random_base32()
        db.session.commit()

    # Build the otpauth URI
    uri = pyotp.totp.TOTP(user.mfa_secret).provisioning_uri(
        name=user.username,
        issuer_name="MyFlaskApp"
    )

    # Generate QR code image
    img = qrcode.make(uri)
    buf = io.BytesIO()
    img.save(buf, format='PNG')
    buf.seek(0)
    return send_file(buf, mimetype='image/png')

4. Verify the Token During Login

After the user supplies a valid password, check whether MFA is enabled. If so, prompt for the 6‑digit TOTP.

def verify_mfa(user, token):
    if not user.mfa_enabled or not user.mfa_secret:
        return False
    totp = pyotp.TOTP(user.mfa_secret)
    return totp.verify(token, valid_window=1)  # Allows a 30‑second clock skew

5. Update the Login Flow

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        user = User.query.filter_by(username=username).first()

        if user and check_password_hash(user.password_hash, password):
            if user.mfa_enabled:
                session['pre_mfa_user_id'] = user.id
                return redirect(url_for('mfa_challenge'))
            login_user(user)
            return redirect(url_for('dashboard'))

    return render_template('login.html')

@app.route('/mfa', methods=['GET', 'POST'])
def mfa_challenge():
    user_id = session.get('pre_mfa_user_id')
    if not user_id:
        return redirect(url_for('login'))

    user = User.query.get(user_id)

    if request.method == 'POST':
        token = request.form['token']
        if verify_mfa(user, token):
            login_user(user)
            session.pop('pre_mfa_user_id')
            return redirect(url_for('dashboard'))
        flash('Invalid authentication code.')

    return render_template('mfa.html')

6. Allow Users to Disable or Reset MFA

Provide a secure flow that requires re‑authentication (password + existing MFA) before letting users turn MFA off or generate a new secret.

Implementing MFA in Django with django‑two‑factor‑auth

If you’re using Django, the django-two-factor-auth package offers a plug‑and‑play solution that integrates with the built‑in admin, REST frameworks, and custom login views.

Installation

pip install django-two-factor-auth[phonenumbers]  # optional phonenumbers for SMS

Configuration Steps

1. Add the required apps to INSTALLED_APPS:

   INSTALLED_APPS = [
       # …
       'django_otp',
       'django_otp.plugins.otp_static',
       'django_otp.plugins.otp_totp',
       'two_factor',
       # …
   ]

2. Include the URL patterns:

   urlpatterns = [
       # …
       path('account/', include('two_factor.urls', 'two_factor')),
       # …
   ]

3. Run migrations:

   python manage.py migrate

4. Optionally enable the LoginView that forces MFA for all users or only those with user.is_staff etc.

After these steps, Django automatically presents a QR code during the first login, stores the secret in the database, and validates TOTP codes on subsequent logins.

Best Practices for Secure MFA Implementation

• Never store plain‑text secrets. Use Django’s EncryptedField or encrypt the secret before persisting it.
• Enforce rate limiting. Limit MFA verification attempts to mitigate brute‑force attacks (e.g., 5 attempts per 10 minutes).
• Provide backup codes. Generate a set of one‑time use backup codes for users who lose access to their authenticator device.
• Support multiple factors. Allow users to choose between TOTP, push, or SMS based on their preferences and threat model.
• Log MFA events. Record successful and failed MFA attempts with timestamps and IP addresses for audit trails.
• Use HTTPS everywhere. MFA tokens are sensitive; always transmit them over TLS.

Testing Your MFA Flow

Automated tests ensure that MFA works reliably across environments. Below is a pytest example for a Flask TOTP flow.

import pytest, pyotp

from app import create_app, db, User

@pytest.fixture

def client():

    app = create_app({'TESTING': True})

    with app.test_client() as client:

        with app.app_context():

            db.create_all()

            yield client

            db.session.remove()

            db.drop_all()
def test_mfa_login(client

Are you looking to let users log into your Python web app with their GitHub accounts? Leveraging GitHub’s OAuth 2.0 service not only streamlines the sign‑in experience but also opens the door to powerful GitHub APIs, enabling you to fetch repositories, issues, and more on behalf of authenticated users. In this guide we’ll walk through the entire Python GitHub OAuth authentication flow, from registering your OAuth app on GitHub to handling callbacks, exchanging authorization codes for access tokens, and finally securing the user session. Whether you’re building a Flask micro‑service or a full‑featured Django portal, the steps below will give you a solid, production‑ready foundation.

Why Choose GitHub OAuth for Your Python Application?

• Trusted Identity Provider: Millions of developers already have GitHub accounts, making sign‑in frictionless.
• Rich API Access: Once authenticated, you can call GitHub’s REST or GraphQL APIs to read user data, repositories, pull requests, and more.
• Secure Token Management: OAuth 2.0 uses short‑lived access tokens and optional refresh tokens, reducing the risk of credential leakage.
• Easy Integration: Popular Python frameworks (Flask, Django, FastAPI) have mature libraries that abstract most of the boilerplate.

Step‑by‑Step Overview of the GitHub OAuth Flow

1. Register your application on GitHub. Obtain a Client ID and Client Secret.
2. Redirect the user to GitHub’s authorization endpoint. Include scopes and a state parameter.
3. GitHub authenticates the user and asks for consent.
4. GitHub redirects back to your callback URL with an authorization code and the original state.
5. Exchange the code for an access token. Make a POST request to GitHub’s token endpoint.
6. Use the access token to call GitHub APIs or store it securely for later use.

Registering Your OAuth App on GitHub

Before any code is written, you must create an OAuth app in your GitHub account:

• Navigate to GitHub Settings → Developer settings → OAuth Apps.
• Click “New OAuth App”.
• Fill in the required fields:
  • Application name – e.g., “MyPythonApp”.
  • Homepage URL – your public site or http://localhost:5000 for local testing.
  • Authorization callback URL – where GitHub will redirect after login (e.g., http://localhost:5000/auth/callback).
• Save to receive a Client ID and Client Secret. Keep the secret private!

Implementing the Flow in Flask

Flask is lightweight and perfect for demonstrating the OAuth dance. Below is a minimal, yet production‑ready, implementation.

Project Structure

myapp/
│
├─ app.py
├─ config.py
└─ requirements.txt

Installing Dependencies

pip install Flask requests python-dotenv

Configuration (config.py)

import os
from dotenv import load_dotenv

load_dotenv()  # Loads variables from .env file

GITHUB_CLIENT_ID = os.getenv('GITHUB_CLIENT_ID')
GITHUB_CLIENT_SECRET = os.getenv('GITHUB_CLIENT_SECRET')
BASE_URL = os.getenv('BASE_URL', 'http://localhost:5000')

Core Application (app.py)

from flask import Flask, redirect, request, session, url_for, jsonify
import requests
from config import GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, BASE_URL

app = Flask(__name__)
app.secret_key = 'replace‑with‑a‑strong‑random‑value'  # Needed for session handling

# ----------------------------------------------------------------------
# Helper: Build the GitHub authorization URL
# ----------------------------------------------------------------------
def github_authorize_url(state):
    params = {
        'client_id': GITHUB_CLIENT_ID,
        'redirect_uri': f'{BASE_URL}{url_for("callback")}',
        'scope': 'read:user repo',   # Adjust scopes as needed
        'state': state
    }
    url = 'https://github.com/login/oauth/authorize'
    request_url = requests.Request('GET', url, params=params).prepare().url
    return request_url

# ----------------------------------------------------------------------
# Route: Home – offers a “Login with GitHub” button
# ----------------------------------------------------------------------
@app.route('/')
def index():
    return (
        f'
Welcome to MyPythonApp
'
        f'Login with GitHub'
    )

# ----------------------------------------------------------------------
# Route: Initiates the OAuth flow
# ----------------------------------------------------------------------
@app.route('/login')
def login():
    # Generate a random state token to protect against CSRF
    state = os.urandom(16).hex()
    session['oauth_state'] = state
    return redirect(github_authorize_url(state))

# ----------------------------------------------------------------------
# Route: Callback – GitHub redirects here after user consent
# ----------------------------------------------------------------------
@app.route('/auth/callback')
def callback():
    # Verify state parameter
    received_state = request.args.get('state')
    if received_state != session.get('oauth_state'):
        return 'Invalid state parameter', 400

    code = request.args.get('code')
    token_url = 'https://github.com/login/oauth/access_token'
    headers = {'Accept': 'application/json'}
    payload = {
        'client_id': GITHUB_CLIENT_ID,
        'client_secret': GITHUB_CLIENT_SECRET,
        'code': code,
        'redirect_uri': f'{BASE_URL}{url_for(\"callback\")}',
        'state': received_state
    }

    # Exchange code for access token
    token_response = requests.post(token_url, data=payload, headers=headers)
    token_json = token_response.json()
    access_token = token_json.get('access_token')

    if not access_token:
        return f'Error retrieving access token: {token_json}', 400

    # Store token in session (or a database for longer‑term storage)
    session['github_token'] = access_token
    return redirect(url_for('profile'))

# ----------------------------------------------------------------------
# Route: Profile – demonstrates an authenticated API call
# ----------------------------------------------------------------------
@app.route('/profile')
def profile():
    token = session.get('github_token')
    if not token:
        return redirect(url_for('index'))

    api_url = 'https://api.github.com/user'
    headers = {'Authorization': f'token {token}'}
    user_resp = requests.get(api_url, headers=headers).json()

    # Simple JSON output; in a real app you’d render a template
    return jsonify(user_resp)

if __name__ == '__main__':
    app.run(debug=True)

This script performs the full OAuth cycle:

• Generates a state token to mitigate CSRF attacks.
• Redirects the user to GitHub’s /login/oauth/authorize endpoint.
• Validates the returned state and exchanges the code for an access token.
• Uses the token to request the authenticated user’s profile via https://api.github.com/user.

Adapting the Flow for Django

If you prefer Django, the same concepts apply, but you’ll typically rely on a library such as social-auth-app-django. Below is a concise configuration outline.

Install Required Packages

pip install Django social-auth-app-django python-dotenv

Update settings.py

import os
from dotenv import load_dotenv

load_dotenv()

AUTHENTICATION_BACKENDS = (
    'social_core.backends.github.GithubOAuth2',
    'django.contrib.auth.backends.ModelBackend',
)

SOCIAL_AUTH_GITHUB_KEY = os.getenv('GITHUB_CLIENT_ID')
SOCIAL_AUTH_GITHUB_SECRET = os.getenv('GITHUB_CLIENT_SECRET')
SOCIAL_AUTH_GITHUB_SCOPE = ['read:user', 'repo']

LOGIN_REDIRECT_URL = '/'
LOGOUT_REDIRECT_URL = '/'

URL Configuration (urls.py)

from django.urls import path, include
from django.contrib import admin

urlpatterns = [
    path('admin/', admin.site.urls),
    path('auth/', include('social_django.urls', namespace='social')),
    path('', include('myapp.urls')),  # Your app’s own routes
]

Template Snippet for Login

<a href="{% url 'social:begin' 'github' %}">Login with GitHub</a>

With social-auth-app-django handling the heavy lifting, you get automatic state verification, token storage, and user model integration out of the box.

Best Practices for Secure Token Management

• Never expose Client Secret on the client side. Keep it on the server and use environment variables.
• Use HTTPS in production. OAuth redirects over plain HTTP are vulnerable to man‑in‑the‑middle attacks.
• Validate the state parameter. It protects against CSRF and should be stored per‑session.

<

Integrating Google OAuth2 login into a Python web application is a powerful way to boost user experience, improve security, and leverage Google’s trusted authentication system. Whether you’re building a small Flask prototype or a full‑featured Django portal, the process follows a clear set of steps that can be mastered quickly. In this guide we’ll walk through everything you need—from creating a Google API project and configuring credentials, to writing clean Python code that handles the OAuth2 flow, validates tokens, and securely logs users in. By the end, you’ll have a production‑ready implementation that not only simplifies sign‑ups but also enhances SEO with relevant keywords like “Python Google OAuth2 login integration.”

What Is OAuth2 and Why Use Google for Authentication?

OAuth2 is an open standard for access delegation, allowing users to grant limited access to their resources without sharing passwords. Google’s OAuth2 service is especially popular because:

• Trust: Users already trust Google’s login UI, reducing friction.
• Security: Tokens are short‑lived and can be revoked at any time.
• Rich Profile Data: With the appropriate scopes you can fetch the user’s email, name, and profile picture.
• SEO Benefits: Implementing a modern authentication flow signals a well‑maintained site to search engines.

Step 1: Create a Google Cloud Project and OAuth2 Credentials

1.1 Open the Google Cloud Console

Navigate to Google Cloud Console and sign in with a Google account that has project‑creation rights.

1.2 Set Up a New Project

1. Click New Project and give it a descriptive name (e.g., MyPythonApp‑OAuth).
2. Choose an organization or keep it under “No organization.”
3. Click Create and wait for the project to provision.

1.3 Enable the “Google+ API” (or “People API” for newer implementations)

From the left navigation, select APIs & Services > Library, search for “People API,” and click Enable. This API provides the profile information you’ll request.

1.4 Create OAuth2 Client ID

1. Go to APIs & Services > Credentials and click Create Credentials > OAuth client ID.
2. Choose Web application as the application type.
3. Enter a name like PythonOAuthClient.
4. Under Authorized redirect URIs, add the URL where Google should send the auth response (e.g., http://localhost:5000/auth/callback for Flask or http://localhost:8000/accounts/google/login/callback/ for Django).
5. Click Create. Copy the Client ID and Client Secret – you’ll need them in your Python code.

Step 2: Install Required Python Packages

Both Flask and Django have dedicated extensions that simplify the OAuth2 flow. Install the core libraries using pip:

pip install requests
pip install google-auth
pip install google-auth-oauthlib
# Flask specific
pip install Flask Flask-Login Flask-OAuthlib
# Django specific
pip install Django social-auth-app-django

These packages handle token exchange, session management, and user model integration, letting you focus on business logic.

Step 3: Implement Google OAuth2 in Flask

3.1 Basic Flask App Skeleton

from flask import Flask, redirect, url_for, session, request
from flask_oauthlib.client import OAuth

app = Flask(__name__)
app.secret_key = 'YOUR_RANDOM_SECRET_KEY'

oauth = OAuth(app)
google = oauth.remote_app(
    'google',
    consumer_key='YOUR_CLIENT_ID',
    consumer_secret='YOUR_CLIENT_SECRET',
    request_token_params={
        'scope': 'email profile'
    },
    base_url='https://www.googleapis.com/oauth2/v1/',
    request_token_url=None,
    access_token_method='POST',
    access_token_url='https://oauth2.googleapis.com/token',
    authorize_url='https://accounts.google.com/o/oauth2/auth',
)

3.2 Login Route

@app.route('/login')
def login():
    return google.authorize(
        callback=url_for('authorized', _external=True)
    )

3.3 Authorization Callback

@app.route('/auth/callback')
def authorized():
    resp = google.authorized_response()
    if resp is None or resp.get('access_token') is None:
        return 'Access denied: reason=%s error=%s' % (
            request.args['error_reason'],
            request.args['error_description']
        )
    session['google_token'] = (resp['access_token'], '')
    user_info = google.get('userinfo')
    # Example: store user info in session
    session['user'] = {
        'email': user_info.data['email'],
        'name':  user_info.data['name'],
        'picture': user_info.data['picture']
    }
    return redirect(url_for('profile'))

3.4 Token Getter

@google.tokengetter
def get_google_oauth_token():
    return session.get('google_token')

3.5 Protected Profile Page

@app.route('/profile')
def profile():
    if 'user' not in session:
        return redirect(url_for('login'))
    user = session['user']
    return f\"\"\"<h2>Welcome, {user['name']}!</h2>
               <img src='{user['picture']}' alt='Profile picture'>
               <p>Email: {user['email']}</p>\"\"\"

Run the app with flask run, visit /login, and you’ll be redirected to Google’s consent screen. After granting access, the user lands on the profile page with their Google data.

Step 4: Implement Google OAuth2 in Django Using Social‑Auth

4.1 Configure Settings

# settings.py
INSTALLED_APPS = [
    # … default apps …
    'social_django',
]

AUTHENTICATION_BACKENDS = (
    'social_core.backends.google.GoogleOAuth2',
    'django.contrib.auth.backends.ModelBackend',
)

SOCIAL_AUTH_GOOGLE_OAUTH2_KEY = 'YOUR_CLIENT_ID'
SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET = 'YOUR_CLIENT_SECRET'

LOGIN_URL = 'login'
LOGIN_REDIRECT_URL = 'profile'
LOGOUT_REDIRECT_URL = 'home'

# Optional: request extra profile fields
SOCIAL_AUTH_GOOGLE_OAUTH2_SCOPE = ['email', 'profile']
SOCIAL_AUTH_GOOGLE_OAUTH2_EXTRA_DATA = ['first_name', 'last_name']

4.2 URL Configuration

# urls.py
from django.urls import path, include
from . import views

urlpatterns = [
    path('', views.home, name='home'),
    path('profile/', views.profile, name='profile'),
    path('auth/', include('social_django.urls', namespace='social')),
]

4.3 Simple Views

# views.py
from django.shortcuts import render, redirect
from django.contrib.auth.decorators import login_required

def home(request):
    return render(request, 'home.html')

@login_required
def profile(request):
    user = request.user
    # Social auth stores extra data in user.social_auth
    extra = user.social_auth.get(provider='google-oauth2')
    context = {
        'email': user.email,
        'name': extra.extra_data.get('name'),
        'picture': extra.extra_data.get('picture')
    }
    return render(request, 'profile.html', context)

4.4 Template Snippet for Login

<a href="{% url 'social:begin' 'google-oauth2' %}?next={{ request.path }}">
    Sign in with Google
</a>

After adding the templates, run python manage.py migrate to create the required tables, then start the server. Clicking the “Sign in with Google” link launches the OAuth2 flow, and Django automatically creates or updates the user record.

Step 5: Validate Tokens and Secure Your Integration

Even though Google handles most of the heavy lifting, you should still verify the ID token on the server side to protect against token replay attacks.

• Use google.oauth2.id_token.verify_oauth2_token() to decode and validate the token.
• Check the aud (audience) claim matches your client ID.
• Confirm the token has not expired (exp claim).

from google.oauth2 import id_token

from google.auth.transport import requests

def verify_token(id_token_str):

    try:

        idinfo = id_token.verify_oauth2_token(

            id_token_str,

            requests.Request(),

            'YOUR_CLIENT_ID