Flask-oauth is probably your best bet right now for a flask specific way to do it, as far as I know it doesn't support token refreshing but it will work with Facebook, we use it for that and it's oauth 2. If it doesn't need to be flask specific you might look at requests-oauth