From df6f64b0d17a2c3c435b26f33c9f030bd47a3ce8 Mon Sep 17 00:00:00 2001 From: Sourav Basu Date: Wed, 29 Jul 2026 11:43:33 +0530 Subject: [PATCH 1/5] docs: fix broken pip/poetry install command and unquoted dict key --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 93df38f..7e6c165 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ pip install auth0-server-python If you’re using Poetry: ```shell -poetry install auth0-server-python +poetry add auth0-server-python ``` ### 2. Create the Auth0 SDK client @@ -40,7 +40,7 @@ auth0 = ServerClient( client_secret='', secret='', authorization_params= { - redirect_uri: '', + 'redirect_uri': '', } ) ``` From 79d8c6650f47793b2a709e8d07834fd42b43f35b Mon Sep 17 00:00:00 2001 From: Sourav Basu Date: Wed, 29 Jul 2026 11:43:33 +0530 Subject: [PATCH 2/5] docs: fix ServerClient import path (no top-level package export) --- examples/ClientInitiatedBackChannelLogin.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/ClientInitiatedBackChannelLogin.md b/examples/ClientInitiatedBackChannelLogin.md index 67aef88..5ab71fa 100644 --- a/examples/ClientInitiatedBackChannelLogin.md +++ b/examples/ClientInitiatedBackChannelLogin.md @@ -15,7 +15,7 @@ Before using backchannel authentication: ### Initiating Backchannel Authentication ```python -from auth0_server_python import ServerClient +from auth0_server_python.auth_server import ServerClient # Initialize the Auth0 client auth0 = ServerClient( @@ -101,7 +101,7 @@ Read more above in [Configuring the Store](./ConfigureStore.md). from fastapi import FastAPI, Request from fastapi.responses import JSONResponse -from auth0_server_python import ServerClient +from auth0_server_python.auth_server import ServerClient app = FastAPI() From ad78d233a22b645b55242a3b141d5af0765a3143 Mon Sep 17 00:00:00 2001 From: Sourav Basu Date: Wed, 29 Jul 2026 11:43:33 +0530 Subject: [PATCH 3/5] docs: fix ServerClient import path (no top-level package export) --- examples/MultipleCustomDomains.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/MultipleCustomDomains.md b/examples/MultipleCustomDomains.md index 442cf0a..ec6c68b 100644 --- a/examples/MultipleCustomDomains.md +++ b/examples/MultipleCustomDomains.md @@ -19,7 +19,7 @@ See [Security Best Practices](#security-best-practices) for important guidance o For applications with a single Auth0 domain: ```python -from auth0_server_python import ServerClient +from auth0_server_python.auth_server import ServerClient client = ServerClient( domain="login.yourapp.com", # Static string @@ -34,7 +34,7 @@ client = ServerClient( For MCD support, provide a domain resolver function that receives a `DomainResolverContext`: ```python -from auth0_server_python import ServerClient +from auth0_server_python.auth_server import ServerClient from auth0_server_python.auth_types import DomainResolverContext # Map your app hostnames to Auth0 custom domains From 42500c4e9462c4c242a9711ef23800172236e5a5 Mon Sep 17 00:00:00 2001 From: Sourav Basu Date: Wed, 29 Jul 2026 11:43:33 +0530 Subject: [PATCH 4/5] docs: fix store import path and hoist inline json imports --- examples/ConfigureStore.md | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/examples/ConfigureStore.md b/examples/ConfigureStore.md index 5afeadf..90e5a95 100644 --- a/examples/ConfigureStore.md +++ b/examples/ConfigureStore.md @@ -37,7 +37,7 @@ If you’re using `auth0-fastapi`, you already have: 2. **CookieTransactionStore** – stores short-lived transaction data (PKCE code_verifier) in another encrypted cookie. ```python -from store.abstract import StateStore, TransactionStore +from auth0_server_python.store import StateStore, TransactionStore class StatelessStateStore(StateStore): def __init__(self, secret: str, cookie_name: str = "_a0_session"): @@ -98,9 +98,10 @@ A **stateful** approach stores only a **session ID** in the cookie, while the ac ### 3.1. Redis-Based Example Let’s walk through a `RedisStateStore` that inherits from `StateStore`: ```python +import json import aioredis from typing import Any, Dict, Optional -from store.abstract import StateStore +from auth0_server_python.store import StateStore class RedisStateStore(StateStore): """ @@ -133,7 +134,6 @@ class RedisStateStore(StateStore): # encrypted_data = self.encrypt(session_id, state) # await self.redis_client.set(session_id, encrypted_data) # For demo, let's store it as JSON without encryption: - import json await self.redis_client.set(session_id, json.dumps(state)) # Now set a cookie in the response with just the session_id @@ -166,7 +166,6 @@ class RedisStateStore(StateStore): return None # If you used self.encrypt(...) on set, call self.decrypt(...) here. - import json return json.loads(raw_data) async def delete( @@ -206,7 +205,6 @@ class RedisStateStore(StateStore): for k in keys: raw_data = await self.redis_client.get(k) if raw_data: - import json session_data = json.loads(raw_data) # If your session_data stores an internal dict with `sid` or `sub` internal = session_data.get("internal", {}) @@ -240,9 +238,10 @@ Now your user’s session data is in **Redis**, and only a minimal session ID is If you prefer a **SQL database** for session data, here’s a `PostgresStateStore` example using [asyncpg](https://github.com/MagicStack/asyncpg). ```python +import json import asyncpg from typing import Any, Dict, Optional -from store.abstract import StateStore +from auth0_server_python.store import StateStore class PostgresStateStore(StateStore): """ @@ -277,7 +276,6 @@ class PostgresStateStore(StateStore): # Optionally encrypt `state`: # encrypted_data = self.encrypt(session_id, state) # For simplicity, store as JSON - import json data_json = json.dumps(state) # Insert or update the session @@ -322,7 +320,6 @@ class PostgresStateStore(StateStore): if not row: return None # If you used encryption, do self.decrypt(...) - import json return json.loads(row["session_data"]) async def delete( From 59844c0ca7f50d011fdccfda36d60a96d1846903 Mon Sep 17 00:00:00 2001 From: Sourav Basu Date: Wed, 29 Jul 2026 11:43:33 +0530 Subject: [PATCH 5/5] docs: fix syntax error and JS-style naming in Python examples --- examples/RetrievingData.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/examples/RetrievingData.md b/examples/RetrievingData.md index d1fcc11..457b6f0 100644 --- a/examples/RetrievingData.md +++ b/examples/RetrievingData.md @@ -5,12 +5,12 @@ The SDK's `get_user()` can be used to retrieve the current logged-in user: ```python -user = await serverClient.get_user(); +user = await server_client.get_user() ``` ### Passing Store Options -Just like most methods, `getUser` accept an argument that is used to pass to the configured Transaction and State Store: +Just like most methods, `get_user` accept an argument that is used to pass to the configured Transaction and State Store: ```python store_options = { @@ -27,7 +27,7 @@ Read more above in [Configuring the Store](./ConfigureStore.md). The SDK's `get_session()` can be used to retrieve the current session data: ```python -session = await serverClient.get_session(); +session = await server_client.get_session() ``` ### Passing Store Options @@ -58,7 +58,7 @@ In order to do this, the SDK needs access to a Refresh Token. By default, the SD ### Passing Store Options -Just like most methods, `getAccessToken` accept an argument that is used to pass to the configured Transaction and State Store: +Just like most methods, `get_access_token` accept an argument that is used to pass to the configured Transaction and State Store: ```python store_options = { @@ -225,7 +225,7 @@ token = await server_client.get_access_token(audience="https://api.example.com") # Avoid unless necessary: Dynamic scopes increase session size token = await server_client.get_access_token( - audience="https://api.example.com" + audience="https://api.example.com", scope="openid profile email read:products write:products admin:all" ) ``` @@ -244,7 +244,7 @@ access_token_for_google = await server_client.get_access_token_for_connection(co ``` - `connection`: The connection for which an access token should be retrieved, e.g. `google-oauth2` for Google. -- `loginHint`: Optional login hint to inform which connection account to use, can be useful when multiple accounts for the connection exist for the same user. +- `login_hint`: Optional login hint to inform which connection account to use, can be useful when multiple accounts for the connection exist for the same user. The SDK will cache the token internally, and return it from the cache when not expired. When no token is found in the cache, or the token is expired, calling `get_access_token_for_connection()` will call Auth0 to retrieve a new token and update the cache.