# Resource Servers

Changed in version v1.0.0: We have removed built-in SQLAlchemy integrations.

Protect users resources, so that only the authorized clients with the authorized access token can access the given scope resources.

A resource server can be a different server other than the authorization server. Here is the way to protect your users’ resources:

    from flask import jsonify
    from authlib.integrations.flask_oauth1 import ResourceProtector, current_credential

    # we will define ``query_client``, ``query_token``, and ``exists_nonce`` later.
    require_oauth = ResourceProtector(
        app, query_client=query_client,
        query_token=query_token,
        exists_nonce=exists_nonce,
    )
    # or initialize it lazily
    require_oauth = ResourceProtector()
    require_oauth.init_app(
        app,
        query_client=query_client,
        query_token=query_token,
        exists_nonce=exists_nonce,
    )

    @app.route('/user')
    @require_oauth()
    def user_profile():
        user = current_credential.user
        return jsonify(user)

The `current_credential` is a proxy to the Token model you have defined above. Since there is a `user` relationship on the Token model, we can access this `user` with `current_credential.user`.

## Initialize

To initialize `ResourceProtector`, we need three functions:

1. query_client

2. query_token

3. exists_nonce

If using SQLAlchemy, the `query_client` could be:

    def query_client(client_id):
        # assuming ``Client`` is the model
        return Client.query.filter_by(client_id=client_id).first()

And `query_token` would be:

    def query_token(client_id, oauth_token):
        return TokenCredential.query.filter_by(client_id=client_id, oauth_token=oauth_token).first()

For `exists_nonce`, if you are using cache now (as in authorization server), Authlib has a built-in tool function:

    from authlib.integrations.flask_oauth1 import create_exists_nonce_func
    exists_nonce = create_exists_nonce_func(cache)

If using database, with SQLAlchemy it would look like:

    def exists_nonce(nonce, timestamp, client_id, oauth_token):
        q = db.session.query(TimestampNonce.nonce).filter_by(
            nonce=nonce,
            timestamp=timestamp,
            client_id=client_id,
        )
        if oauth_token:
            q = q.filter_by(oauth_token=oauth_token)
        rv = q.first()
        if rv:
            return True

        tn = TimestampNonce(
            nonce=nonce,
            timestamp=timestamp,
            client_id=client_id,
            oauth_token=oauth_token,
        )
        db.session.add(tn)
        db.session.commit()
        return False

## MethodView & Flask-Restful

You can also use the `require_oauth` decorator in `flask.views.MethodView` and `flask_restful.Resource`:

    from flask.views import MethodView

    class UserAPI(MethodView):
        decorators = [require_oauth()]

    from flask_restful import Resource

    class UserAPI(Resource):
        method_decorators = [require_oauth()]