Quickly Authenticate Users with FastAPI and Token Authentication

In this 2 part series on API Authentication, Tim from @TechWithTim explains how to build an authenticated API using python and Fast API. In this first episode, we'll cover how to set up a FastAPI project and start using tokens to authenticate users. Be sure to subscribe to catch the second video in this series.

Chapters:
0:00 - Introduction
1:58 - Install Python Packages
4:36 - FastAPI import and Project Setup
7:08 - Access FastAPI documentation
8:48 - Using Query and Path Parameters
11:03 - How to Accept API Requests
13:30 - Set up API User Authentication
19:36 - Hashing and Authenticating Passwords
26:30 - Create an Access Token based on Login Data
33:50 - Writing a Token Root
40:51 - Testing Token Authorization
45:31 - Conclusion

#Linode #FastAPI #API #TechWithTim
Product: Linode, API, FastAPI; @TechWithTim

[DreamsAPI]

Thank you Tim for teaching and sharing.
To all, study, take breaks, apply knowledge and understanding, keep learning, before you know it your understanding is increasing and becomes comprehensible overtime.

[mohitashliya]

Thanks man, All my doubts regarding the Basemodels and those 2 astrisks and OAuth2 are cleared here.

[pradnyamane]

Thanks for video, and line by line explanation .. helpful for the user, using the OAUTH for first time.

[octaverossi]

what a tutorial. Hats off for this one

[vengtCent]

Thank you Tim for sharing your knowledge although it's fastt paced i could follow pretty good.
It would be nice if you'd explain the code more extensively. For example why did you chose to make the functions get_current_user and get_current_active_user async?

[joaovictor-dlve]

Is possible to create with Oauth a role and permission model similar to RBAC?

[randomforest_dev]

from what I previously understand, first user login with username and password from login form and gets jwt token, second user send that jwt token to protected api routes, middleware extract the token from header and check if it is valid or not and decides to continue or stop the request. But the logic in FastAPI is a bit complicated. why do I need to pass again the username and password to access every protected routes?

[soldadopreciso]

But is there some info of path login, logout, signup?

[Rabixter]

This is quite confusing to be honest. But I appreciate its the nature of the topic, not the fault of the video. Will probably need to watch this again.

[TheSuloman]

Awesome, but i need second part, where is it?

[BHAVESHMADHUSUDHANKARAPU]

im getting an error of "'openssl' is not recognized as an internal or external command,
operable program or batch file." while creating Secret Key

[guneetsingh]

Is it possible not to give hardcoded db in the code, as its a senstive information.

[danielstatler]

got stuck on the openssl rannd -hex 32 bit. installed pyopenssl. pip list shows its installed. terminal says there is no such module. tried to add it to path but couldnt find the file for it.

If i cant even follow a tutorial, should i just give up on programming? i swear to god nothing ever works when i try and do it

[__async]

For some this may be usefull, if you return an list and wnat to show it in docs response example, use response_model=list[schema] in api decorator. And with python 3.11 you do not need to use response_model var in api decorator but instead use function type hints as:

async def my_func(…) -> list[schema]:

FastAPI is the best :]

[drchastr]

I have facing a problem in line 98 where it says db is not defined I don't really see db written or defined in your code but I see that we have named it fake_db. so what is happening ?

[evam]

This is all great but how come there isn’t a library that does most of this work for you ??

[parij]

How to test the same on Postman instead of Swagger?

[DanielRodriguez-luuu]

It's kind of the same stuff you will find on FastAPI documentation. Real value would be to show the real flow with a login page, as that part is not that straight forward.

[basembarakat]

Thanks for the tutorial. Wondering when the token expiration time is checked? Does jwt.decode check this internally?

[jeff_gh]

Would the same logic apply if I'd use Templates (jinja2) to display a frontend?