How to handle API authentication in Python
Jul 13, 2025 am 02:22 AMThe key to handling API authentication is to understand and use the authentication method correctly. 1. API Key is the simplest authentication method, usually placed in the request header or URL parameters; 2. Basic Auth uses username and password for Base64 encoding transmission, suitable for internal systems; 3. OAuth2 needs to obtain the token first through client_id and client_secret, and then bring a Bearer Token in the request header; 4. In order to deal with the token expiration, the token management class can be encapsulated and automatically refreshed the token; in short, selecting the appropriate method according to the document and safely storing the key information is the key.
Handling API authentication is not actually mysterious. The key is to understand the authentication method you use and how to use it correctly in Python. The authentication mechanisms used by different APIs may be different, but the most common methods are: API Key, Basic Auth, OAuth1, and OAuth2. Let’s take a look at how these common methods are handled in Python.

Use API Key to authenticate
Many services verify the request source through a simple API Key, which is usually sent as part of the request headers.
The method is very simple:

- Add
Authorization
field to the request header, the value isAPI_KEY
- Or append
key=your_api_key
to the URL parameter
import requests headers = { 'Authorization': 'your_api_key_here' } response = requests.get('https://api.example.com/data', headers=headers)
Some APIs require you to use specific field names in the header, such as
X-API-Key
. At this time, you cannot forceAuthorization
, you have to see the documentation instructions.
Using Basic Auth
Basic Auth is a relatively basic HTTP authentication method. Usually, the user name and password are combined into a string and then Base64 encoding is passed to the server.

Python's requests library provides built-in support:
import requests response = requests.get( 'https://api.example.com/data', auth=('username', 'password') )
This method is suitable for testing or internal system use and is not recommended for public services because credentials are easily intercepted.
Use OAuth2 to get the token and call the API
Now many services use the OAuth2 process to obtain the access token (Token), and then use this token to initiate subsequent requests.
The general process is as follows:
- Apply for token from the authentication server (client_id and client_secret are required)
- Received the returned access_token
- Take
Authorization: Bearer your_token
import requests # Get Token data = { 'grant_type': 'client_credentials' } auth = ('client_id', 'client_secret') response = requests.post('https://api.example.com/oauth/token', data=data, auth=auth) token = response.json()['access_token'] # Use Token to request data headers = {'Authorization': f'Bearer {token}'} data_response = requests.get('https://api.example.com/data', headers=headers)
The implementation details of OAuth2 on different platforms may vary slightly, such as some need to add scope, and some need to specify content-type. Remember to refer to the official documentation.
Handle Token Expiration and Automatic Refresh
Tokens generally have validity periods, and they need to be re-acquisitioned after they expire. If you are writing long-term service (such as background tasks), it is recommended to encapsulate a Token management class.
You can design the logic like this:
- Get the token before the first request
- Save the token and expiration time
- Determine whether the token expires before each request
- If it expires, re-acquire
import time class TokenManager: def __init__(self, client_id, client_secret): self.client_id = client_id self.client_secret = client_secret self.token = None self.expires_at = 0 def get_token(self): if time.time() >= self.expires_at: # Simulate requests for new tokens self.token = 'new_token' self.expires_at = time.time() 3600 # Assume that one hour expires return self.token
After encapsulation, get_token()
method can be called uniformly when actually calling the API to avoid frequent manual refresh.
Basically that's it. Although there are a lot of authentication methods, each has a fixed routine. The key is to choose the right method based on the document and pay attention to safely storing the key information.
The above is the detailed content of How to handle API authentication in Python. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

The key to dealing with API authentication is to understand and use the authentication method correctly. 1. APIKey is the simplest authentication method, usually placed in the request header or URL parameters; 2. BasicAuth uses username and password for Base64 encoding transmission, which is suitable for internal systems; 3. OAuth2 needs to obtain the token first through client_id and client_secret, and then bring the BearerToken in the request header; 4. In order to deal with the token expiration, the token management class can be encapsulated and automatically refreshed the token; in short, selecting the appropriate method according to the document and safely storing the key information is the key.

The way to access nested JSON objects in Python is to first clarify the structure and then index layer by layer. First, confirm the hierarchical relationship of JSON, such as a dictionary nested dictionary or list; then use dictionary keys and list index to access layer by layer, such as data "details"["zip"] to obtain zip encoding, data "details"[0] to obtain the first hobby; to avoid KeyError and IndexError, the default value can be set by the .get() method, or the encapsulation function safe_get can be used to achieve secure access; for complex structures, recursively search or use third-party libraries such as jmespath to handle.

Asynchronous programming is made easier in Python with async and await keywords. It allows writing non-blocking code to handle multiple tasks concurrently, especially for I/O-intensive operations. asyncdef defines a coroutine that can be paused and restored, while await is used to wait for the task to complete without blocking the entire program. Running asynchronous code requires an event loop. It is recommended to start with asyncio.run(). Asyncio.gather() is available when executing multiple coroutines concurrently. Common patterns include obtaining multiple URL data at the same time, reading and writing files, and processing of network services. Notes include: Use libraries that support asynchronously, such as aiohttp; CPU-intensive tasks are not suitable for asynchronous; avoid mixed

To test the API, you need to use Python's Requests library. The steps are to install the library, send requests, verify responses, set timeouts and retry. First, install the library through pipinstallrequests; then use requests.get() or requests.post() and other methods to send GET or POST requests; then check response.status_code and response.json() to ensure that the return result is in compliance with expectations; finally, add timeout parameters to set the timeout time, and combine the retrying library to achieve automatic retry to enhance stability.

In Python, variables defined inside a function are local variables and are only valid within the function; externally defined are global variables that can be read anywhere. 1. Local variables are destroyed as the function is executed; 2. The function can access global variables but cannot be modified directly, so the global keyword is required; 3. If you want to modify outer function variables in nested functions, you need to use the nonlocal keyword; 4. Variables with the same name do not affect each other in different scopes; 5. Global must be declared when modifying global variables, otherwise UnboundLocalError error will be raised. Understanding these rules helps avoid bugs and write more reliable functions.

In Python, there is no need for temporary variables to swap two variables. The most common method is to unpack with tuples: a, b=b, a. This method first evaluates the right expression to generate a tuple (b, a), and then unpacks it to the left variable, which is suitable for all data types. In addition, arithmetic operations (addition, subtraction, multiplication and division) can be used to exchange numerical variables, but only numbers and may introduce floating point problems or overflow risks; it can also be used to exchange integers, which can be implemented through three XOR operations, but has poor readability and is usually not recommended. In summary, tuple unpacking is the simplest, universal and recommended way.

To create modern and efficient APIs using Python, FastAPI is recommended; it is based on standard Python type prompts and can automatically generate documents, with excellent performance. After installing FastAPI and ASGI server uvicorn, you can write interface code. By defining routes, writing processing functions, and returning data, APIs can be quickly built. FastAPI supports a variety of HTTP methods and provides automatically generated SwaggerUI and ReDoc documentation systems. URL parameters can be captured through path definition, while query parameters can be implemented by setting default values ??for function parameters. The rational use of Pydantic models can help improve development efficiency and accuracy.

Add timeout control to Python's for loop. 1. You can record the start time with the time module, and judge whether it is timed out in each iteration and use break to jump out of the loop; 2. For polling class tasks, you can use the while loop to match time judgment, and add sleep to avoid CPU fullness; 3. Advanced methods can consider threading or signal to achieve more precise control, but the complexity is high, and it is not recommended for beginners to choose; summary key points: manual time judgment is the basic solution, while is more suitable for time-limited waiting class tasks, sleep is indispensable, and advanced methods are suitable for specific scenarios.
