​
1. Install dependencies

pip install "civic-auth[flask]"

​
2. Configure your App

Your app will need the following configuration:

config = {
    "client_id": "...",  # Client ID from auth.civic.com
    "redirect_url": "http://localhost:5000/auth/callback",  # change to your domain when deploying
    "post_logout_redirect_url": "http://localhost:5000/"  # The postLogoutRedirectUrl is the URL where the user will be redirected after successfully logging out from Civic's auth server.
}

Note: redirect_url and post_logout_redirect_url must be absolute URLs.

​
3. Initialize Civic Auth

Set up Civic Auth with your Flask app:

from flask import Flask
from civic_auth.integrations.flask import init_civic_auth, create_auth_blueprint

app = Flask(__name__)
app.secret_key = "your-secret-key"  # Required for session handling

# Initialize Civic Auth
init_civic_auth(app, config)

# Register the auth blueprint (provides /auth/* routes)
app.register_blueprint(create_auth_blueprint(config))

​
4. Login and Logout Routes

The auth blueprint automatically creates these routes:

  • /auth/login - Initiates the login flow
  • /auth/callback - Handles the OAuth callback
  • /auth/logout - Logs the user out

You can redirect users to start the login process:

from flask import redirect, url_for

@app.route("/")
def index():
    return redirect(url_for("civic_auth.login"))

​
5. Protect Routes

Use the civic_auth_required decorator to protect routes:

from civic_auth.integrations.flask import civic_auth_required

@app.route("/admin/hello")
@civic_auth_required
async def hello():
    return "Hello, authenticated user!"

​
6. Access User Information

Use get_civic_user() to access the logged-in user:

from civic_auth.integrations.flask import get_civic_user

@app.route("/admin/profile")
@civic_auth_required
async def profile():
    user = await get_civic_user()
    return {
        "id": user.id,
        "email": user.email,
        "name": user.name,
        "picture": user.picture
    }

​
PKCE and Client Secrets

Civic Auth uses PKCE (Proof Key for Code Exchange), to protect users and clients from unauthorized access to user information. This, alongside domain registration for apps in production environments, mean that you don’t need to provide a client secret in your backend.

When using the Civic Auth SDK, PKCE is handled entirely by the library.