litestar-auth-guards

Implement Litestar authentication guards, JWT checks, and WebSocket authorization patterns.

Updated Aug 17, 2026

Search Tags:#authorization #authentication #python #jwt #websocket #guards #litestar

Ready to run

npx skills add https://github.com/renjianguo666/litecms --skill litestar-auth-guards-renjianguo666

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: litestar-auth-guards
Source: https://github.com/renjianguo666/litecms/tree/main/.agents/skills/litestar-auth-guards
Command: npx skills add https://github.com/renjianguo666/litecms --skill litestar-auth-guards-renjianguo666

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires litestar, and includes references (resource) components.

What problem does it solve? It guides developers in placing Litestar authentication and authorization logic in Guards and middleware instead of duplicating checks inside route handlers, covering HTTP, JWT, multi-tenant, and WebSocket scenarios. ## Core Features & Use Cases - Guard Patterns: Provides reusable guard callables for active-user, superuser, JWT bearer token, and workspace membership checks applied at Controller or route scope. - WebSocket Auth: Supplies query-param JWT guards with 4001/4003 close-code conventions for workspace, user-subject, and global-access streams. - Use Case: When building a multi-tenant Litestar API, apply Controller-level guards like requires_active_user and requires_workspace_membership so every endpoint enforces tenant isolation without inline auth branching. ## Quick Start Ask the AI to add a Litestar guard that requires an active authenticated user for a Controller and verify the denial path returns the expected status.

Frequently Asked Questions about litestar-auth-guards

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add authentication guards in Litestar?▼

Define an async callable taking (connection, route_handler) that raises PermissionDeniedException when connection.user is missing or inactive, then attach it via the guards list on a Controller or route handler. Controller-level guards apply the policy to every handler in that controller.

How to implement JWT bearer token auth in Litestar?▼

Decode the Authorization header token with Token.decode using your secret key and algorithm, raising PermissionDeniedException on missing or invalid tokens. For auto-loading the user onto connection.user, use JWT middleware instead of a per-route guard.

Can Litestar guards handle WebSocket authentication?▼

Yes, but WebSocket handshakes cannot carry HTTP Authorization headers, so pass the JWT as a query parameter. Guards raise WebSocketException with code 4001 for auth failures and 4003 for authorization failures like missing workspace membership.

Should auth checks go in Litestar guards or middleware?▼

Use middleware to load the user once onto connection.user, and guards to enforce permission policies per Controller or route. Avoid guards that repeatedly query the database when middleware can load identity a single time per request.

When should I not use Litestar guards for validation?▼

Guards are for authentication and permission boundaries, not business validation or frontend route protection. Domain input validation belongs in handlers or services, while guards only decide whether the caller may access the resource.