Implement and validate FastAPI authentication strategies including JWT tokens, OAuth2 password flows, OAuth2 scopes for permissions, and Supabase integration. Use when implementing authentication, securing endpoints, handling user login/signup, managing permissions, integrating OAuth providers, or when user mentions JWT, OAuth2, Supabase auth, protected routes, access control, role-based permissions, or authentication errors.
Limited to specific tools
Additional assets for this skill
This skill is limited to using the following tools:
README.mdexamples/permission_system.pyexamples/protected_routes.pyscripts/setup-jwt.shscripts/validate-auth.shtemplates/jwt_auth.pytemplates/oauth2_flow.pytemplates/supabase_auth.pyPurpose: Autonomously implement, validate, and debug FastAPI authentication systems with multiple strategies.
Activation Triggers:
Key Resources:
scripts/setup-jwt.sh - Initialize JWT authentication systemscripts/validate-auth.sh - Validate authentication configurationtemplates/jwt_auth.py - Complete JWT authentication implementationtemplates/oauth2_flow.py - OAuth2 password flow with scopestemplates/supabase_auth.py - Supabase integration for FastAPIexamples/protected_routes.py - Protected endpoint patternsexamples/permission_system.py - Role and permission-based accessUse When:
Setup:
./scripts/setup-jwt.sh
Core Components:
Implementation Pattern:
# Hash passwords (never store plaintext)
password_hash = PasswordHash.recommended()
hashed = password_hash.hash(plain_password)
# Generate JWT token
def create_access_token(data: dict, expires_delta: timedelta):
to_encode = data.copy()
expire = datetime.now(timezone.utc) + expires_delta
to_encode.update({"exp": expire})
return jwt.encode(to_encode, SECRET_KEY, algorithm="HS256")
# Validate token and extract user
async def get_current_user(token: str = Depends(oauth2_scheme)):
payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
username = payload.get("sub")
return get_user(username)
Key Points:
Use When:
Template: templates/oauth2_flow.py
Flow:
OAuth2PasswordRequestFormSecurity Scheme:
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
@app.post("/token")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
user = authenticate_user(form_data.username, form_data.password)
access_token = create_access_token(data={"sub": user.username})
return {"access_token": access_token, "token_type": "bearer"}
Use When:
Template: See templates/oauth2_flow.py (includes scopes)
Define Scopes:
oauth2_scheme = OAuth2PasswordBearer(
tokenUrl="token",
scopes={
"me": "Read information about current user",
"items": "Read items",
"items:write": "Create and modify items"
}
)
Encode Scopes in Token:
# During login, add user's scopes to token
token_data = {"sub": username, "scopes": user.scopes}
access_token = create_access_token(token_data)
Protect Endpoints with Scopes:
async def get_current_user(
security_scopes: SecurityScopes,
token: str = Depends(oauth2_scheme)
):
# Validate token has required scopes
for scope in security_scopes.scopes:
if scope not in token_data.scopes:
raise HTTPException(401, "Not enough permissions")
@app.get("/users/me/items/")
async def read_items(
current_user: User = Security(get_current_active_user, scopes=["items"])
):
return current_user.items
Use When:
Template: templates/supabase_auth.py
Setup:
from supabase import create_client, Client
supabase: Client = create_client(
os.getenv("SUPABASE_URL"),
os.getenv("SUPABASE_KEY")
)
Sign Up:
# Email/password signup
response = supabase.auth.sign_up({
"email": "user@example.com",
"password": "secure_password",
"options": {"data": {"full_name": "John Doe"}}
})
Sign In:
response = supabase.auth.sign_in_with_password({
"email": "user@example.com",
"password": "secure_password"
})
access_token = response.session.access_token
Validate Token in FastAPI:
async def get_current_user(token: str = Depends(oauth2_scheme)):
# Validate Supabase JWT token
user = supabase.auth.get_user(token)
return user
Integration Pattern:
./scripts/validate-auth.sh
Checks Performed:
Missing SECRET_KEY:
# Generate secure random key
openssl rand -hex 32
# Add to .env
echo 'SECRET_KEY=your_generated_key' >> .env
Token Expired (401):
Invalid Credentials:
Missing Permissions (403):
Supabase Connection Failed:
Example: examples/protected_routes.py
# Public endpoint (no auth)
@app.get("/")
async def root():
return {"message": "Public endpoint"}
# Protected endpoint (requires authentication)
@app.get("/users/me")
async def read_users_me(current_user: User = Depends(get_current_user)):
return current_user
# Protected with specific permission
@app.post("/items/")
async def create_item(
item: Item,
current_user: User = Security(get_current_active_user, scopes=["items:write"])
):
return create_item_for_user(current_user, item)
# Admin-only endpoint
@app.delete("/users/{user_id}")
async def delete_user(
user_id: int,
current_user: User = Depends(get_current_admin_user)
):
return delete_user_by_id(user_id)
Example: examples/permission_system.py
Role-Based Access Control (RBAC):
class Role(str, Enum):
ADMIN = "admin"
USER = "user"
GUEST = "guest"
class User(BaseModel):
username: str
role: Role
permissions: List[str]
def has_permission(user: User, required_permission: str) -> bool:
# Admins have all permissions
if user.role == Role.ADMIN:
return True
return required_permission in user.permissions
async def require_permission(permission: str):
async def permission_checker(current_user: User = Depends(get_current_user)):
if not has_permission(current_user, permission):
raise HTTPException(403, f"Permission '{permission}' required")
return current_user
return permission_checker
# Usage
@app.delete("/items/{item_id}")
async def delete_item(
item_id: int,
current_user: User = Depends(require_permission("items:delete"))
):
return delete_item_by_id(item_id)
Security:
Token Management:
Scope Design:
Error Handling:
Required Packages:
pip install fastapi
pip install python-jose[cryptography]
pip install pwdlib[argon2]
pip install supabase # If using Supabase
Environment Variables:
SECRET_KEY=your_secret_key_here
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=30
# For Supabase
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your_anon_key
Supported Auth Strategies: JWT, OAuth2 Password Flow, OAuth2 Scopes, Supabase
Version: 1.0.0 FastAPI Compatibility: 0.100+