oidc-jwt-verifier

oidc-jwt-verifier is a Python library designed for verifying JWT access tokens issued by OIDC/JWKS providers. It addresses the need for secure and reliable token validation in Python-based services, particularly those that require strict adherence to OpenID Connect and JWT standards. The library is suitable for both synchronous and asynchronous Python applications, offering a stable synchronous verifier (JWTVerifier) and a native asynchronous verifier (AsyncJWTVerifier) tailored for ASGI environments.

The tool enforces comprehensive security checks for each token. These include signature validation against keys from a configured JWKS URL, issuer (iss) and audience (aud) verification, and time-based checks such as expiration (exp) and not-before (nbf). It also enforces an algorithm allowlist and explicitly rejects tokens with the 'alg=none' setting. Authorization checks for required scopes and permissions are built in, and the library is designed to reject unsafe JWT header parameters like 'jku', 'x5u', and 'crit'. Key endpoints are never derived from token headers, further reducing potential attack surfaces. Strict fail-closed security defaults are implemented, and the library provides RFC 6750-compatible error headers for consistent error handling.

Integration helpers are available for FastAPI and Starlette, making it easier to incorporate JWT verification into popular Python web frameworks. The library is framework-agnostic, focusing solely on the verification of signed JWT access tokens with explicit issuer, audience, and JWKS configuration. It does not handle OAuth/OIDC client flows, OIDC discovery, automatic endpoint derivation, or session management, keeping its scope focused on token verification and related error semantics.

oidc-jwt-verifier is intended for developers building Python services that require robust JWT access token validation, particularly in applications where security and standards compliance are critical.