Use only what you need
- ✓Just gate one page behind a PIN?
— a shared PIN or passphrase, no user account required. - ✓Forward-auth in front of other apps, like TinyAuth?
— yes, via/auth/forwardor a ready-made OIDC gateway. - ✓Want an admin panel?
— built in. Prefer it inside your own? — use just the JSON API. - ✓From “a password is enough” to “OIDC → password → TOTP”?
— it grows with you; every piece optional, on/off by config. - ✓Your own look & language?
— the whole front end is replaceable (set_template), texts in English or German.
Ways to sign in
🔐 Password🔢 PIN🔑 Passkey / WebAuthn🌐 OIDC · Entra🪪 SAML 2.0🗂️ LDAP / Active Directory✉️ Magic-link📱 TOTP + recovery codes
And more
Factor chainsordered combinations like OIDC → password, per route or global
Step-up MFAre-confirm before sensitive routes — with a PIN, TOTP or the password
Register & inviteself-signup, email verification, invitation links
Sign in with what you wantusername, email or both —
login_identifierShared resource secretprotect an area with a PIN/passphrase, no account
Forward-authguard other apps via Caddy / nginx / Traefik
Admin panel & API keysusers, sessions, service accounts, audit log
Hardenedargon2, CSRF, brute-force lockout, Redis rate-limit, i18n
Install
pip install "tinysesam[all] @ git+https://github.com/Ollornog/TinySesam.git@v0.24.2"
[all] pulls every optional dependency. Take only what you need:
[argon2]stronger hashing[oidc]OIDC login[saml]SAML 2.0[ldap]LDAP/AD[passkey]WebAuthn[qr]TOTP QR code[redis]rate limit across workers[gateway]forward-auth gateway (OIDC + server)
Combine them: [oidc,argon2]. Without any extra you still get password + TOTP (stdlib scrypt).
Use
auth = TinySesam(TinySesamConfig(db_path="app.db"))
app.include_router(auth.router()) # /auth/* + login UI
@app.get("/")
def home(user = Depends(auth.require_user)): # protected
return {"hi": user["username"]}
Want just SSO in front of existing apps? Run it as an OIDC forward-auth gateway.