ch8Q %SSKJr SSKJrJr SSKJrJrJrJ r J r SSK J r J r Jr SSKJrJrJrJr SSKJrJr SSKJrJr SSKJr SS KJr SS KJr SS K!J"r" \(aSS KJ#r# \ RH"\%5r&S \'S'Sr(S \'S'Sr)S \'S'\"S5S S!Sjj5r*\"S5S"Sj5r+S#Sjr,S$Sjr-"SS\\.\ \.\/S445r0Sq1S"Sjr2"SS\05r3g)%) annotations)IteratorMapping) TYPE_CHECKINGAnyFinalNoReturnUnion)configloggerruntime)encode_provider_tokenget_secrets_auth_sectionis_authlib_installedvalidate_auth_credentials)make_deprecated_name_warningshow_deprecation_warning)StreamlitAPIExceptionStreamlitAuthError) ForwardMsg)gather_metrics)get_script_run_ctx) make_url_path)UserInfor_LOGGERz /auth/loginAUTH_LOGIN_ENDPOINTz /auth/logoutAUTH_LOGOUT_ENDPOINTloginNcUcSn[5nUb[[5(d [S5e[U5 [ 5n[ U5UR lURU5 gg)a"Initiate the login flow for the given provider. This command redirects the user to an OpenID Connect (OIDC) provider. After the user authenticates their identity, they are redirected back to the home page of your app. Streamlit stores a cookie with the user's identity information in the user's browser . You can access the identity information through |st.user|_. Call ``st.logout()`` to remove the cookie and start a new session. You can use any OIDC provider, including Google, Microsoft, Okta, and more. You must configure the provider through secrets management. Although OIDC is an extension of OAuth 2.0, you can't use generic OAuth providers. Streamlit parses the user's identity token and surfaces its attributes in ``st.user``. If the provider returns an access token, that token is ignored. Therefore, this command will not allow your app to act on behalf of a user in a secure system. For all providers, there are two shared settings, ``redirect_uri`` and ``cookie_secret``, which you must specify in an ``[auth]`` dictionary in ``secrets.toml``. Other settings must be defined as described in the ``provider`` parameter. - ``redirect_uri`` is your app's absolute URL with the pathname ``oauth2callback``. For local development using the default port, this is ``http://localhost:8501/oauth2callback``. - ``cookie_secret`` should be a strong, randomly generated secret. In addition to the shared settings, the following settings are required: - ``client_id`` - ``client_secret`` - ``server_metadata_url`` For a complete list of OIDC parameters, see `OpenID Connect Core `_ and your provider's documentation. By default, Streamlit sets ``scope="openid profile email"`` and ``prompt="select_account"``. You can change these and other OIDC parameters by passing a dictionary of settings to ``client_kwargs``. ``state`` and ``nonce``, which are used for security, are handled automatically and don't need to be specified. For more information, see Example 4. .. Important:: - You must install ``Authlib>=1.3.2`` to use this command. You can install it as an extra with Streamlit: >>> pip install streamlit[auth] - Your authentication configuration is dependent on your host location. When you deploy your app, remember to update your ``redirect_uri`` within your app and your provider. - All URLs declared in the settings must be absolute (i.e., begin with ``http://`` or ``https://``). - Streamlit automatically enables CORS and XSRF protection when you configure authentication in ``secrets.toml``. This takes precedence over configuration options in ``config.toml``. - If a user is logged into your app and opens a new tab in the same browser, they will automatically be logged in to the new session with the same account. - If a user closes your app without logging out, the identity cookie will expire after 30 days. - For security reasons, authentication is not supported for embedded apps. .. |st.user| replace:: ``st.user`` .. _st.user: https://docs.streamlit.io/develop/api-reference/user/st.user Parameters ---------- provider: str or None The name of your provider configuration to use for login. If ``provider`` is ``None`` (default), Streamlit will use all settings in the ``[auth]`` dictionary within your app's ``secrets.toml`` file. Otherwise, use an ``[auth.{provider}]`` dictionary for the named provider, as shown in the examples that follow. When you pass a string to ``provider``, Streamlit will use ``redirect_uri`` and ``cookie_secret``, while ignoring any other values in the ``[auth]`` dictionary. Due to internal implementation details, Streamlit does not support using an underscore within ``provider`` at this time. Examples -------- **Example 1: Use an unnamed default identity provider** If you do not specify a name for your provider, specify all settings within the ``[auth]`` dictionary of your ``secrets.toml`` file. The following example configures Google as the default provider. For information about using OIDC with Google, see `Google Identity `_. ``.streamlit/secrets.toml``: >>> [auth] >>> redirect_uri = "http://localhost:8501/oauth2callback" >>> cookie_secret = "xxx" >>> client_id = "xxx" >>> client_secret = "xxx" >>> server_metadata_url = "https://accounts.google.com/.well-known/openid-configuration" # fmt: skip Your app code: >>> import streamlit as st >>> >>> if not st.user.is_logged_in: >>> if st.button("Log in"): >>> st.login() >>> else: >>> if st.button("Log out"): >>> st.logout() >>> st.write(f"Hello, {st.user.name}!") **Example 2: Use a named identity provider** If you specify a name for your provider, save the shared settings in the ``[auth]`` dictionary of your ``secrets.toml`` file, and save the other settings in an ``[auth.{provider}]`` dictionary, where ``{provider}`` is the name of your provider. The following example configures Microsoft as the provider. The example uses ``provider="microsoft"``, but you can use any name. This name is internal to Streamlit and is used to match the login command to its configuration. For information about using OIDC with Microsoft, see `Microsoft Entra ID `_. To configure your ``{tenant}`` value in ``server_metadata_url``, see `Microsoft identity platform `_. ``.streamlit/secrets.toml``: >>> [auth] >>> redirect_uri = "http://localhost:8501/oauth2callback" >>> cookie_secret = "xxx" >>> >>> [auth.microsoft] >>> client_id = "xxx" >>> client_secret = "xxx" >>> server_metadata_url = "https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration" Your app code: >>> import streamlit as st >>> >>> if not st.user.is_logged_in: >>> st.login("microsoft") >>> else: >>> st.write(f"Hello, {st.user.name}!") **Example 3: Use multiple, named providers** If you want to give your users a choice of authentication methods, configure multiple providers and give them each a unique name. The following example lets users choose between Okta and Microsoft to log in. Always check with your identity provider to understand the structure of their identity tokens because the returned fields may differ. Remember to set ``{tenant}`` and ``{subdomain}`` in ``server_metadata_url`` for Microsoft and Okta, respectively. >>> [auth] >>> redirect_uri = "http://localhost:8501/oauth2callback" >>> cookie_secret = "xxx" >>> >>> [auth.microsoft] >>> client_id = "xxx" >>> client_secret = "xxx" >>> server_metadata_url = "https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration" >>> >>> [auth.okta] >>> client_id = "xxx" >>> client_secret = "xxx" >>> server_metadata_url = "https://{subdomain}.okta.com/.well-known/openid-configuration" # fmt: skip Your app code: >>> import streamlit as st >>> >>> if not st.user.is_logged_in: >>> st.header("Log in:") >>> if st.button("Microsoft"): >>> st.login("microsoft") >>> if st.button("Okta"): >>> st.login("okta") >>> else: >>> if st.button("Log out"): >>> st.logout() >>> st.write(f"Hello, {st.user.name}!") **Example 4: Change the default connection settings** ``prompt="select_account"`` may be treated differently by some providers when a user is already logged into their account. If a user is logged into their Google or Microsoft account from a previous session, the provider will prompt them to select the account they want to use, even if it's the only one. However, if the user is logged into their Okta or Auth0 account from a previous session, the account will automatically be selected. ``st.logout()`` does not clear a user's related cookies. To force users to log in every time, use ``prompt="login"`` as described in Auth0's `Customize Signup and Login Prompts `_. ``.streamlit/secrets.toml``: >>> [auth] >>> redirect_uri = "http://localhost:8501/oauth2callback" >>> cookie_secret = "xxx" >>> >>> [auth.auth0] >>> client_id = "xxx" >>> client_secret = "xxx" >>> server_metadata_url = "https://{account}.{region}.auth0.com/.well-known/openid-configuration" # fmt: skip >>> client_kwargs = { "prompt" = "login" } Your app code: >>> import streamlit as st >>> >>> if st.button("Log in"): >>> st.login("auth0") >>> if st.user.is_logged_in: >>> if st.button("Log out"): >>> st.logout() >>> st.write(f"Hello, {st.user.name}!) NdefaultzcTo use authentication features, you need to install Authlib>=1.3.2, e.g. via `pip install Authlib`.) _get_script_run_ctxrrrrgenerate_login_redirect_url auth_redirecturlenqueue)providercontextfwd_msgs fC:\Users\julio\OneDrive\Documentos\Trabajo\Ideas Frescas\venv\Lib\site-packages\streamlit/user_info.pyrr7soF!#G#%%$F  "(+,$?$I! logoutc[5nUbURR5 URn[R "5(a&[R "5nURU5 [R"S5n[5n[U[5URlURU5 gg)a~Logout the current user. This command removes the user's information from ``st.user``, deletes their identity cookie, and redirects them back to your app's home page. This creates a new session. If the user has multiple sessions open in the same browser, ``st.user`` will not be cleared in any other session. ``st.user`` only reads from the identity cookie at the start of a session. After a session is running, you must call ``st.login()`` or ``st.logout()`` within that session to update ``st.user``. .. Note:: This does not log the user out of their underlying account from the identity provider. Example ------- ``.streamlit/secrets.toml``: >>> [auth] >>> redirect_uri = "http://localhost:8501/oauth2callback" >>> cookie_secret = "xxx" >>> client_id = "xxx" >>> client_secret = "xxx" >>> server_metadata_url = "https://accounts.google.com/.well-known/openid-configuration" # fmt: skip Your app code: >>> import streamlit as st >>> >>> if not st.user.is_logged_in: >>> if st.button("Log in"): >>> st.login() >>> else: >>> if st.button("Log out"): >>> st.logout() >>> st.write(f"Hello, {st.user.name}!") Nserver.baseUrlPath)r! user_infoclear session_idr exists get_instanceclear_user_info_for_sessionr get_optionrrrr#r$r%)r'r0instance base_pathr(s r)r+r+*sR"#G!'' >>  ++-H  0 0 <%%&:; ,$1)=Q$R! r*cr[U5n[R"S5n[U[5nUSU3$)z7Generate the login redirect URL for the given provider.r-z ?provider=)rr r4rr)r&provider_tokenr6 login_paths r)r"r"cs<*84N!!"67Iy*=>J\N#3 44r*c[5nUc[RS5 0$URR 5n[ 5nSU;a U(aSUS'U$)NzINo script run context available. st.user will return an empty dictionary. is_logged_inF)r!rwarningr.copyr)ctxcontext_user_infoauth_section_existss r)_get_user_inforAks^  C { W   **,24..3F,1.) r*c^\rSrSrSrS SjrS SjrS SjrS SjrSSjr SSjr SS jr S r g ) UserInfoProxyi|a  A read-only, dict-like object for accessing information about the current user. ``st.user`` is dependent on the host platform running your Streamlit app. If your host platform has not configured the object, ``st.user`` will behave as it does in a locally running app. When authentication is configured in ``secrets.toml``, Streamlit will parse the OpenID Connect (OIDC) identity token and copy the attributes to ``st.user``. Check your provider's documentation for their available attributes (known as claims). When authentication is not configured, ``st.user`` has no attributes. You can access values via key or attribute notation. For example, use ``st.user["email"]`` or ``st.user.email`` to access the ``email`` attribute. .. Important:: Identity tokens include an issuance and expiration time. Streamlit does not implicitly check these. If you want to automatically expire a user's authentication, check these values manually and programmatically log out your user (``st.logout()``) when needed. Attributes ---------- is_logged_in: bool Whether a user is logged in. For a locally running app, this attribute is only available when authentication (``st.login()``) is configured in ``secrets.toml``. Otherwise, it does not exist. Examples -------- **Example 1: Google's identity token** If you configure a basic Google OIDC connection as shown in Example 1 of ``st.login()``, the following data is available in ``st.user``. Streamlit adds the ``is_logged_in`` attribute. Additional attributes may be available depending on the configuration of the user's Google account. For more information about Google's identity tokens, see `Obtain user information from the ID token `_ in Google's docs. Your app code: >>> import streamlit as st >>> >>> if st.user.is_logged_in: >>> st.write(st.user) Displayed data when a user is logged in: >>> { >>> "is_logged_in":true >>> "iss":"https://accounts.google.com" >>> "azp":"{client_id}.apps.googleusercontent.com" >>> "aud":"{client_id}.apps.googleusercontent.com" >>> "sub":"{unique_user_id}" >>> "email":"{user}@gmail.com" >>> "email_verified":true >>> "at_hash":"{access_token_hash}" >>> "nonce":"{nonce_string}" >>> "name":"{full_name}" >>> "picture":"https://lh3.googleusercontent.com/a/{content_path}" >>> "given_name":"{given_name}" >>> "family_name":"{family_name}" >>> "iat":{issued_time} >>> "exp":{expiration_time} >>> } **Example 2: Microsoft's identity token** If you configure a basic Microsoft OIDC connection as shown in Example 2 of ``st.login()``, the following data is available in ``st.user``. For more information about Microsoft's identity tokens, see `ID token claims reference `_ in Microsoft's docs. Your app code: >>> import streamlit as st >>> >>> if st.user.is_logged_in: >>> st.write(st.user) Displayed data when a user is logged in: >>> { >>> "is_logged_in":true >>> "ver":"2.0" >>> "iss":"https://login.microsoftonline.com/{tenant_id}/v2.0" >>> "sub":"{application_user_id}" >>> "aud":"{application_id}" >>> "exp":{expiration_time} >>> "iat":{issued_time} >>> "nbf":{start_time} >>> "name":"{full_name}" >>> "preferred_username":"{username}" >>> "oid":"{user_GUID}" >>> "email":"{email}" >>> "tid":"{tenant_id}" >>> "nonce":"{nonce_string}" >>> "aio":"{opaque_string}" >>> } cX[5U$![a [SUS35ef=f)Nzst.user has no key "".)rAKeyErrorselfkeys r) __getitem__UserInfoProxy.__getitem__s9 ;!#C( ( ;1#b9: : ; )cX[5U$![a [SUS35ef=f)Nzst.user has no attribute "rE)rArFAttributeErrorrGs r) __getattr__UserInfoProxy.__getattr__s< G!#C( ( G #=cU"!EF F GrLc[S5eNzst.user cannot be modifiedrrHnamevalues r) __setattr__UserInfoProxy.__setattr__#$@AAr*c[S5erRrSrTs r) __setitem__UserInfoProxy.__setitem__rYr*c([[55$N)iterrArHs r)__iter__UserInfoProxy.__iter__sN$%%r*c([[55$r^)lenrAr`s r)__len__UserInfoProxy.__len__s>#$$r*c[5$)a  Get user info as a dictionary. This method primarily exists for internal use and is not needed for most cases. ``st.user`` returns an object that inherits from ``dict`` by default. Returns ------- Dict[str,str] A dictionary of the current user's information. )rAr`s r)to_dictUserInfoProxy.to_dicts r*N)rIstrreturnzstr | bool | None)rUrkrV str | Nonerlr )rlz Iterator[str])rlintrlr) __name__ __module__ __qualname____firstlineno____doc__rJrOrWr[rarerh__static_attributes__rjr*r)rCrC|s/l\; G BB&%  r*rCFcL[(dSq[[SSS55 gg)z;Show a deprecation warning for the experimental_user alias.Texperimental_useruserz 2025-11-06N)#has_shown_experimental_user_warningrrrjr*r)"maybe_show_deprecated_user_warningrzs. / ..2+ (#   /r*c@^\rSrSrSrSU4SjjrSU4SjjrSrU=r$)DeprecatedUserInfoProxyi%zw A deprecated alias for UserInfoProxy. This class is deprecated and will be removed in a future version of Streamlit. c6>[5 [TU] U5$r^)rzsuper__getattribute__)rHrU __class__s r)r(DeprecatedUserInfoProxy.__getattribute__-s*,w'--r*c6>[5 [TU] U5$r^)rzr~rJ)rHrIrs r)rJ#DeprecatedUserInfoProxy.__getitem__1s*,w"3''r*rj)rUrkrlr)rIrkrlr) rprqrrrsrtrrJru __classcell__)rs@r)r|r|%s.((r*r|r^)r&rmrlNone)rlr)r&rkrlrkro)4 __future__rcollections.abcrrtypingrrrr r streamlitr r r streamlit.auth_utilrrrrstreamlit.deprecation_utilrrstreamlit.errorsrrstreamlit.proto.ForwardMsg_pb2rstreamlit.runtime.metrics_utilr7streamlit.runtime.scriptrunner_utils.script_run_contextrr!streamlit.url_utilrr get_loggerrpr__annotations__rrrr+r"rArkboolrCryrzr|rjr*r)rs#-.- G59-P""8,,*U*,e,o!o!d5!5!p5"T GCsD$!778T n',#  (m(r*