AuthCore - Standalone Authentication Service

A reusable internal auth service for handling user authentication across multiple applications.

What it does

AuthCore provides user registration, login, and token management as a standalone microservice. Other services can delegate authentication here instead of building it themselves.

Built as a reusable internal service - not a consumer product.

Design Decisions

Token Strategy

• Access tokens: Short-lived (15 min), contain user info, stateless validation
• Refresh tokens: Long-lived (7 days), stored in DB for revocation capability
• When refresh token expires, user must re-authenticate

Password Security

• PBKDF2 with SHA-256, 100k iterations
• Random salt per password, stored with hash
• Not using bcrypt (wanted to avoid C dependencies)

Role Hierarchy

admin (3) > moderator (2) > user (1)

Roles checked numerically for flexible permission matching.

Rate Limiting

• In-memory store for speed
• Login/register: stricter limits (5-10/hour)
• Refresh: moderate (20/hour)
• Headers returned: X-RateLimit-Remaining, Retry-After

Database

• SQLite for portability (swap to PostgreSQL without changing API)
• Refresh tokens stored separately for easy revocation
• Cascading deletes for user cleanup

Quick Start

# Install dependencies
pip install flask PyJWT

# Run server (port 5002 to avoid conflicts)
python -m src.app 5002

API Usage

Register

curl -X POST http://localhost:5002/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "secretpass123"}'

Login

curl -X POST http://localhost:5002/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "secretpass123"}'

Refresh Token

curl -X POST http://localhost:5002/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refresh_token": "YOUR_REFRESH_TOKEN"}'

Get Current User

curl http://localhost:5002/api/auth/me \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

API Reference

Endpoint	Method	Auth	Description
/api/auth/register	POST	No	Register new user
/api/auth/login	POST	No	Login and get tokens
/api/auth/refresh	POST	No	Refresh access token
/api/auth/logout	POST	Yes	Logout (revoke refresh)
/api/auth/me	GET	Yes	Get current user
/api/users	GET	Admin	List all users
/api/users/<id>/role	PUT	Admin	Update user role
/api/users/<id>/active	PUT	Admin	Enable/disable user
/api/health	GET	No	Health check

Token Response Format

{
  "message": "Login successful",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "role": "user"
  },
  "access_token": "eyJ...",
  "refresh_token": "random-string..."
}

Roles

Role	Level	Permissions
user	1	View own profile
moderator	2	+ moderate content
admin	3	+ manage users/roles

Stack

• Python 3.8+
• Flask
• PyJWT
• SQLite

---

MIT License - deploy it wherever you need auth.