Flask session middleware

Use ScalekitAuth from scalekit.frameworks.flask to add hosted login, an encrypted sk_session cookie, token refresh, and logout.

Typical flow: install the flask extra, construct ScalekitAuth with the Flask app, and decorate one view with @auth.requires_auth.

Requires scalekit-sdk-python 2.17.0 or later.

Register these URLs in the Scalekit Dashboard under Authentication > Redirects before you test:

Dashboard field	Must match
Redirect URI	redirect_uri exactly, for example http://localhost:5001/callback
Post Logout Redirect URI	Absolute URL after full logout, for example http://localhost:5001/
Initiate Login URL	Login path, for example http://localhost:5001/login

Store credentials in environment variables. Never hard-code secrets.

.env

SCALEKIT_ENVIRONMENT_URL=https://your-env.scalekit.com
SCALEKIT_CLIENT_ID=skc_...
SCALEKIT_CLIENT_SECRET=...
COOKIE_ENCRYPTION_SECRET=   # openssl rand -base64 32
REDIRECT_URI=http://localhost:5001/callback

Keep COOKIE_ENCRYPTION_SECRET identical on every server instance. The SDK does not ship a default.

Install the package

Terminal

pip install "scalekit-sdk-python[flask]"

Protect a route

app.py

import os
from flask import Flask
from scalekit.frameworks.flask import ScalekitAuth

app = Flask(__name__)
auth = ScalekitAuth(
    app,
    env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
    client_id=os.environ["SCALEKIT_CLIENT_ID"],
    client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
    redirect_uri=os.environ["REDIRECT_URI"],
    cookie_encryption_secret=os.environ["COOKIE_ENCRYPTION_SECRET"],
    cookie_secure=False,  # set True behind HTTPS
)

@app.route("/account")
@auth.requires_auth
def account():
    return {"sub": auth.current_user["sub"]}

Open http://localhost:5001/account. A missing session returns 302 to /login, not a JSON 401.

auth.current_user is access-token claims. sub is always present. email appears only when you add it as a custom access-token claim.

Set cookie_secure=False on local HTTP

cookie_secure defaults to True. Some browsers drop a Secure cookie on plain http://localhost, which looks like a session that never sticks. Set cookie_secure=False for local HTTP. Set it True in production.

constructor

classScalekitAuthhttps://github.com/scalekit-inc/scalekit-sdk-python/blob/main/scalekit/frameworks/flask.py

#__init__

Creates the Flask session helper. Pass app to register routes immediately, or call init_app later.

paramappFlask | None

Flask app. When provided, registers /login, /callback, and /logout.

optional

paramclientScalekitClient | None

Existing client. When omitted, the constructor builds one from env_url, client_id, and client_secret.

optional

paramenv_urlstr

Scalekit environment URL.

required if client is omitted

paramclient_idstr

Application client ID.

required if client is omitted

paramclient_secretstr

Application client secret.

required if client is omitted

paramredirect_uristr

Exact Redirect URI registered in the dashboard.

paramcookie_encryption_secretstr

Secret used to encrypt sk_session. Generate with openssl rand -base64 32.

paramcookie_namestr

Session cookie name.

optional, default sk_session

paramcookie_securebool

Set False for local HTTP.

optional, default True

paramlogin_pathstr

Login view path.

optional, default /login

paramcallback_pathstr

Callback view path.

optional, default /callback

paramlogout_pathstr

Logout view path.

optional, default /logout

parampost_login_redirectstr

Fallback path after login when returnTo is absent.

optional, default /

parampost_logout_redirect_uristr | None

Where logout lands. Defaults to post_login_redirect.

optional

paramfull_logoutbool

When True, logout ends the Scalekit session with id_token_hint.

optional, default True

returnsScalekitAuth

Helper with requires_auth, current_user, and get_session.

auth = ScalekitAuth(
    app,
    env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
    client_id=os.environ["SCALEKIT_CLIENT_ID"],
    client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
    redirect_uri=os.environ["REDIRECT_URI"],
    cookie_encryption_secret=os.environ["COOKIE_ENCRYPTION_SECRET"],
)

init_app

classScalekitAuthhttps://github.com/scalekit-inc/scalekit-sdk-python/blob/main/scalekit/frameworks/flask.py

#init_app

Registers the login, callback, and logout views on a Flask app. Use this when you construct ScalekitAuth without app.

paramappFlask

Flask application.

returnsNone

Routes are added in place.

auth = ScalekitAuth(
    redirect_uri=os.environ["REDIRECT_URI"],
    cookie_encryption_secret=os.environ["COOKIE_ENCRYPTION_SECRET"],
    env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
    client_id=os.environ["SCALEKIT_CLIENT_ID"],
    client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
)
auth.init_app(app)

requires_auth

classScalekitAuthhttps://github.com/scalekit-inc/scalekit-sdk-python/blob/main/scalekit/frameworks/flask.py

#requires_auth

View decorator that requires a valid session. Sets g.scalekit_user and refreshes the cookie about 10 seconds before expiry. Redirects to login_path when the session is missing.

paramview_funcCallable

Flask view to protect.

returnsCallable

Wrapped view. Missing session → 302, never JSON 401.

@app.route("/billing")
@auth.requires_auth
def billing():
    return {"sub": auth.current_user["sub"]}

current_user

classScalekitAuthhttps://github.com/scalekit-inc/scalekit-sdk-python/blob/main/scalekit/frameworks/flask.py

#current_user

Access-token claims for the current request. Same object as g.scalekit_user.

returnsdict | None

Claims when requires_auth has run, otherwise None.

sub = auth.current_user["sub"]

get_session

classScalekitAuthhttps://github.com/scalekit-inc/scalekit-sdk-python/blob/main/scalekit/frameworks/flask.py

#get_session

Read-only session lookup for a public page that shows logged-in vs logged-out state. Does not refresh or write a cookie. Only requires_auth refreshes the session.

returnsdict | None

{"user": ..., "expires_at": ...}, or None. Never includes access_token, refresh_token, or id_token.

session = auth.get_session()
if session:
    print(session["user"]["sub"], session["expires_at"])