Macaroons, like cookies, are a form of bearer credential. Unlike opaque tokens, macaroons embed caveats that define specific authorization requirements for the target service, the service that issued the root macaroon and which is capable of verifying the integrity of macaroons it receives.

Macaroons allow for delegation and attenuation of authorization. They are simple and fast to verify, and decouple authorization policy from the enforcement of that policy.

The macaroonbakery library builds on pymacaroons to allow working with macaroons at a higher level, such as by automatically gathering discharge macaroons for third-party caveats from their corresponding services.