Apr 3, 2025

How to build SSO authentication with Python

Founding Architect

Enterprise customers expect Single Sign On (SSO) support in any serious SaaS application—whether you’re building APIs or dashboards using FastAPI, Django, or Flask. But manually integrating protocols like SAML or OIDC with providers like Okta or Microsoft Entra ID is painful and error-prone. This guide shows how to add secure, production-ready SSO to your Python backend using Scalekit’s SDK. You’ll build a complete login and callback flow, manage JWT-based sessions, and test it all locally using an IdP simulator.

What this guide covers

By the end of this guide, you'll have a working Single Sign On authentication flow using Python and Scalekit. You’ll:

Create a login endpoint that redirects to the user’s identity provider (Okta, Entra ID, etc.)
Handle authentication callbacks and extract user profile data
Establish a secure session using JWTs and ^HttpOnly cookies
Test the full flow locally using Scalekit’s built-in IdP simulator
Transition seamlessly to real IdPs in production

The case for SSO in Python-based backends

SSO streamlines enterprise logins. Users sign in once and access multiple tools without juggling passwords. For IT teams, it centralises access control. For developers, it introduces protocol complexity.

Python powers internal tools, APIs, and admin dashboards across industries. Whether you're building in Django or FastAPI, enterprise customers will ask for SSO support. Implementing it cleanly matters for user authentication, onboarding speed, and user experience.

The cost of doing SSO manually in Python

DevOrbit’s identity crisis

DevOrbit, a fictional analytics startup built on FastAPI, ran into trouble as soon as enterprise deals started rolling in. Each customer brought a different IdP: Okta, OneLogin, Microsoft Entra ID. DevOrbit tried to integrate each manually, wiring SAML assertions, mapping user attributes, and chasing token bugs. It didn’t scale.

Engineering cycles were spent debugging SSO flows instead of shipping the product. Their team had to manage configuration files, user records, and token logic manually. Onboarding dragged. Deals stalled. Imagine if DevOrbit switched to Scalekit: they could reduce their auth codebase to just a few lines of code.

Learn how to build SSO in Java Spring Boot

Meet Scalekit: Protocol-agnostic SSO for Python apps

Scalekit removes the need to manage individual SAML or OIDC integrations. It acts as a bridge between your app and the enterprise service provider, simplifying every SSO connection through a single SDK setup.

Configure each identity provider once via the Scalekit dashboard
Redirect users to Scalekit to initiate login
Receive verified user profile details via callback, including the user object and user info
Skip protocol-specific implementation (SAML, OAuth, OIDC)
Use with FastAPI, Flask, or Django in your project directory
Test using the built-in IdP Simulator for successful authentication

Scalekit simplifies the authentication flow, improves user management, and handles URL patterns and configuration details internally.

🔄 How Scalekit simplifies SSO in Python

User clicks “Login with SSO” in your app
Your FastAPI backend calls ^{get_authorization_url()} to generate the authorization request
User is redirected to their IdP (authentication service) via Scalekit
After successful authentication, Scalekit redirects back with a code
Your app exchanges the code for tokens and user info
A session is established (e.g. JWT in cookie)

Implementation overview

Here’s what you’ll implement in this guide:

A login route that initiates SSO by redirecting to the identity provider
A callback handler that verifies the authorization code and extracts user identity
A secure session setup using JWT and cookies in FastAPI
An optional test flow using Scalekit’s IdP simulator

End-to-end SSO flow

Here’s how the Single Sign On flow works with Scalekit and your Python backend:

User clicks “Login with SSO”
Your app uses Scalekit SDK to generate a login redirect URL
Scalekit redirects the user to their assigned Identity Provider (e.g., Okta)
After authentication, the IdP sends the user back to your app with an auth code, completing the SSO connection and allowing the backend to issue secure tokens for session management. The flow supports both SP-initiated and IdP initiated authentication, ensuring compatibility with how enterprise identity providers typically handle user access.
Your app exchanges the code for user profile info and tokens
You establish a session and return the authenticated user to the frontend

Hands-on: Setting up SSO in Python with FastAPI

You can follow along using your own project or the example app provided in Scalekit’s documentation to understand each route and callback in detail.

🛠️ Install the SDK

pip install scalekit-sdk-python

Make sure to install it inside your virtual environment for clean dependency isolation.

⚙️ Set environment variables

SCALEKIT_ENVIRONMENT_URL=your_env_url SCALEKIT_CLIENT_ID=your_client_id SCALEKIT_CLIENT_SECRET=your_secret

These variables provide your authentication service with connection and configuration details.

🔐 Set up the Scalekit client

from scalekit import ScalekitClient, AuthorizationUrlOptions sc = ScalekitClient(env_url, client_id, client_secret)

🔁 Create the login route

@app.get("/auth/login")async def auth_login(request: Request): options = AuthorizationUrlOptions() options.connection_id = "con_123456789" auth_url = sc.get_authorization_url( redirect_uri=redirect_uri, options=options ) return Response(status_code=302, headers={"Location": auth_url})

This route initiates SP-initiated SSO and sends the user to their service provider, but you can also configure IdP initiated logins for scenarios where authentication starts from the identity provider’s dashboard.

🔓 Handle the callback

from fastapi.responses import JSONResponse @app.get("/auth/callback") async def auth_callback(request: Request): code = request.query_params.get("code") token = sc.authenticate_with_code(code, redirect_uri) user_email = token.user.email # Optional: access more profile info response = JSONResponse(content={"email": user_email}) response.set_cookie("access_token", token.accessToken, httponly=True, secure=True) return response

This completes the authentication flow and stores user info securely.

▶️ Run the FastAPI app

uvicorn main:app --reload --port 8080

Make sure your hosts file allows local development on localhost.

🧪 Use the IdP simulator for testing

Use an ^@example.org test email to trigger the simulator
No real IdP setup required

🚪 Run with real IdPs:

Replace connection ID and credentials with production config
Redirect users to their enterprise IdP with one line of code

▶️ Run with actual config

Once the simulator is working, you can authenticate yourself. Use your actual config and try your app.

Managing secure sessions with JWT in Python

Use ^pyjwt to manage sessions after login:

Issue access tokens with short expiry
Store tokens in secure, ^HttpOnly cookies to protect against XSS attacks
Implement refresh tokens if needed for long-lived sessions
Avoid storing tokens in ^localStorage or client-accessible cookies
Include claims like user ID or email address in the token payload

import jwt import time SECRET_KEY = "supersecret" def generate_token(user_id): payload = {"user_id": user_id, "exp": time.time() + 3600} return jwt.encode(payload, SECRET_KEY, algorithm="HS256")

This approach provides user authentication persistence while maintaining security best practices. Alongside tokens, developers should secure any API keys used for authentication or external service calls, storing them only in environment variables and never in source code.

Debugging SSO flows in Python

SSO bugs often stem from misconfigurations. Here’s how to trace them:

Token errors: Check expiry, signature, and audience claim.
Redirect loops: Verify ^redirect_uri and state parameter.
ACS mismatches: Ensure the Assertion Consumer Service (ACS) URL matches what’s in the service provider settings.
Missing configuration files: Check your project directory for the required environment or YAML config.

Use Scalekit logs to trace the authentication flow. You can also inspect token contents to confirm user attributes like email address or user ID.

Best practices for secure Python SSO deployment

Enforce HTTPS for all callback and login routes
Rotate cryptographic keys and API keys regularly to minimize exposure risk and ensure compliance with security best practices.
Enable MFA at the IdP level
Never store tokens in localStorage
Set ^HttpOnly and Secure flags on cookies
Validate all callback inputs
Use centralized logging across Scalekit, your backend, and the authentication service
Use version control to query configuration files and update default values securely

Try running the full flow in your own example app to see how authentication, token exchange, and session management work end to end before deploying to production.

Wrapping Up: SSO without the overhead

This guide covered the entire lifecycle of implementing SSO in a Python backend—from understanding enterprise SSO needs, to setting up routes in FastAPI using Scalekit’s SDK, and securing sessions with JWT. You learned how to test with the IdP simulator, debug common issues, and apply best practices around token handling and cookie storage.

You also saw how SSO fits into broader backend concerns like user authentication, user experience, service provider integration, and secure handling of user info and user accounts.

Enterprise SSO doesn’t have to slow you down. With Scalekit, Python developers can ship secure, scalable authentication in hours, not weeks.

FAQ

Do I need to use Django or FastAPI to implement SSO with Scalekit?

No. The SDK works with any Python backend, including Flask. FastAPI and Django just happen to be the most popular frameworks.

Can I test the SSO flow without connecting a real IdP like Okta or Entra ID?

Yes. Scalekit offers a built-in Test IdP Simulator. Use any @example.org email address to trigger simulated flows.

How do I manage sessions after login in a Python app?

Use JWTs. Issue short-lived access tokens and store them in secure cookies. Optionally add refresh tokens for persistent sessions.

Can I connect multiple Identity Providers in one Python backend?

Yes. Each customer’s IdP can be configured in Scalekit. Use connection_id to route users correctly.

How to implement SSO in Python?

Use the ^{scalekit-sdk-python} package. Set up login and callback routes, configure your org in the dashboard, and test using the IdP simulator.

‍

Want to add enterprise‑grade SSO to your FastAPI, Django or Flask app without weeks of custom code? Sign up for a free Scalekit account to integrate SAML or OIDC quickly using our Python SDK . Have questions about Python SSO flows? Book time with our experts to accelerate your implementation.

No items found.

On this page

Toc link here