AuthWeave 8¶
Six coordinated distributions separate verified identity contracts, human and workload authentication, observability, and message-integrity tooling.
| Need | Distribution |
|---|---|
| Human registration, login, OAuth + PKCE, TOTP, roles, organizations, and opaque sessions in Litestar | litestar-auth |
| Framework-neutral authentication contracts and coordination | authweave-core |
| Workload lifecycle and sender-constrained Resource Server profiles | authweave-workload |
| Security telemetry facade | authweave-otel |
| Standard Webhooks signing and verification | authweave-webhooks |
| Payment HTTP Message Signatures | authweave-http-signatures |
Browser sessions and machine credentials stay on separate trust paths while sharing typed, fail-closed AuthWeave decisions. All distributions require Python 3.12–3.14 and one exact lockstep version.
Start here¶
- Install the distributions you need.
- Follow the quickstart for an opaque cookie session.
- Read credentials and tokens before mixing sessions, challenge JWTs, and workload credentials.
- Review architecture and security posture.
Security boundary¶
Authentication establishes a verified principal and constraints. Your application still owns tenant mapping, row-level security, resource ownership, and business authorization.
AuthWeave intentionally does not provide unconstrained bearer login, user-owned API keys, shared-secret machine or request-signing credentials, an OAuth Authorization Server or STS, generic IAM, or production rollout automation. Token exchange is a strict client for an external STS; it does not operate one.
New Litestar deployments should start on 8.0.1 or newer (current lockstep includes the documentation and import-boundary release). See migrate 7.x → 8.
Optional profiles¶
Merchant onboarding notes for webhooks, DPoP, HTTP Message Signatures, SPIFFE, and introspection live under Workload how-to. Profile readiness is tracked on the roadmap.