Skip to main content Início Criadores forceinjection domain-driven-design-skills fastapi-auth-patterns
fastapi-auth-patterns Implement and validate FastAPI authentication strategies including JWT tokens, OAuth2 password flows, OAuth2 scopes for permissions, and Supabase integration. Use when implementing authentication, securing endpoints, handling user login/signup, managing permissions, integrating OAuth providers, or when user mentions JWT, OAuth2, Supabase auth, protected routes, access control, role-based permissions, or authentication errors.
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Ocupações relacionadas SOC
Baseado na classificação ocupacional SOC
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/ForceInjection/domain-driven-design-skills --skill fastapi-auth-patternsO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... Explorador de arquivos
2 arquivos Mais deste repositório Conduct deep academic research for philosophy, neuroscience, cognitive science, and theoretical computer science (computability, complexity, AI theory, logic). Use when user asks to: research academic topics, find scholarly papers, conduct literature reviews, analyze citations, synthesize research findings, explore philosophical arguments, investigate consciousness/cognition, study computability/decidability/Turing machines, or analyze academic debates. Triggers on: 'research papers', 'literature review', 'academic sources', 'scholarly articles', 'philosophy of mind', 'computability theory', 'neuroscience studies', 'find papers on', 'what does the research say'.
Create clear action plans with steps, success criteria, and risk awareness. Use before implementing features, making changes, starting projects, or anytime you need a roadmap to success. Triggers on "plan this", "how should we approach", "what's the strategy", "steps to complete", or when facing complex multi-step work.
Add keyboard navigation to a feature using CommandRegistryService. Use when implementing keyboard shortcuts, vim-style navigation, or hotkeys for a page or component.
name fastapi-auth-patterns description Implement and validate FastAPI authentication strategies including JWT tokens, OAuth2 password flows, OAuth2 scopes for permissions, and Supabase integration. Use when implementing authentication, securing endpoints, handling user login/signup, managing permissions, integrating OAuth providers, or when user mentions JWT, OAuth2, Supabase auth, protected routes, access control, role-based permissions, or authentication errors. allowed-tools Read, Grep, Glob, Bash, Write, Edit
FastAPI Authentication Patterns
Purpose: Autonomously implement, validate, and debug FastAPI authentication systems with multiple strategies.
Activation Triggers:
Implementing user authentication
Securing API endpoints
JWT token generation/validation issues
OAuth2 flow configuration
Permission and role-based access control
Supabase authentication integration
Authentication errors (401, 403)
Password hashing and security
Key Resources:
scripts/setup-jwt.sh - Initialize JWT authentication systemscripts/validate-auth.sh - Validate authentication configurationtemplates/jwt_auth.py - Complete JWT authentication implementationtemplates/oauth2_flow.py - OAuth2 password flow with scopestemplates/supabase_auth.py - Supabase integration for FastAPIexamples/protected_routes.py - Protected endpoint patterns
examples/permission_system.py
Authentication Strategies
1. JWT Token Authentication
Need stateless authentication
Building API for mobile/web clients
Require token expiration control
Implementing refresh token patterns
Password hashing with Argon2 (pwdlib)
JWT token generation with expiration
Token validation and user extraction
Secure secret key management
password_hash = PasswordHash.recommended()
hashed = password_hash.hash (plain_password)
def create_access_token (data: dict , expires_delta: timedelta ):
to_encode = data.copy()
expire = datetime.now(timezone.utc) + expires_delta
to_encode.update({"exp" : expire})
return jwt.encode(to_encode, SECRET_KEY, algorithm="HS256" )
async def get_current_user (token: str = Depends(oauth2_scheme ) ):
payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256" ])
username = payload.get("sub" )
return get_user(username)
Use environment variables for SECRET_KEY
Default token expiration: 30 minutes
Store username in "sub" claim
Validate token signature and expiration
2. OAuth2 Password Flow
Building first-party applications
Need username/password authentication
Following OAuth2 standards
Integrating with OpenAPI documentation
Template: templates/oauth2_flow.py
User submits credentials via OAuth2PasswordRequestForm
Server verifies password hash
Server returns signed JWT access token
Client includes token in Authorization header
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token" )
@app.post("/token"
async def login (form_data: OAuth2PasswordRequestForm = Depends( ):
user = authenticate_user(form_data.username, form_data.password)
access_token = create_access_token(data={"sub" : user.username})
return {"access_token" : access_token, "token_type" : "bearer" }
3. OAuth2 Scopes (Permissions)
Need fine-grained permission control
Implementing role-based access
Building multi-tenant systems
Following least-privilege principle
Template: See templates/oauth2_flow.py (includes scopes)
oauth2_scheme = OAuth2PasswordBearer(
tokenUrl="token" ,
scopes={
"me" : "Read information about current user" ,
"items" : "Read items" ,
"items:write" : "Create and modify items"
}
)
token_data = {"sub" : username, "scopes" : user.scopes}
access_token = create_access_token(token_data)
Protect Endpoints with Scopes:
async def get_current_user (
security_scopes: SecurityScopes,
token: str = Depends(oauth2_scheme )
):
for scope in security_scopes.scopes:
if scope not in token_data.scopes:
raise HTTPException(401 , "Not enough permissions" )
@app.get("/users/me/items/"
async def read_items (
current_user: User = Security(get_current_active_user, scopes=["items" ] )
):
return current_user.items
4. Supabase Authentication
Using Supabase as backend
Need managed authentication service
Want OAuth providers (Google, GitHub, etc.)
Require user management dashboard
Template: templates/supabase_auth.py
from supabase import create_client, Client
supabase: Client = create_client(
os.getenv("SUPABASE_URL" ),
os.getenv("SUPABASE_KEY" )
)
response = supabase.auth.sign_up({
"email" : "user@example.com" ,
"password" : "secure_password" ,
"options" : {"data" : {"full_name" : "John Doe" }}
})
response = supabase.auth.sign_in_with_password({
"email" : "user@example.com" ,
"password" : "secure_password"
})
access_token = response.session.access_token
Validate Token in FastAPI:
async def get_current_user (token: str = Depends(oauth2_scheme ) ):
user = supabase.auth.get_user(token)
return user
Store Supabase session in HTTP-only cookies (server-side)
Use PKCE flow for OAuth providers
Implement token refresh logic
Leverage Supabase RLS policies for data access
Validation Workflow
1. Run Authentication Validator ./scripts/validate-auth.sh
✅ Required packages installed (fastapi, python-jose[cryptography], passlib[argon2], pwdlib)
✅ Environment variables set (SECRET_KEY, ALGORITHM, ACCESS_TOKEN_EXPIRE_MINUTES)
✅ Security scheme configured correctly
✅ Password hashing implemented
✅ Token generation and validation functions present
✅ Protected endpoints use proper dependencies
2. Common Issues & Fixes
openssl rand -hex 32
echo 'SECRET_KEY=your_generated_key' >> .env
Increase ACCESS_TOKEN_EXPIRE_MINUTES
Implement refresh token pattern
Check server/client time sync
Verify password hashing algorithm matches
Check user exists in database
Validate password comparison logic
Missing Permissions (403):
Verify user has required scopes
Check scope encoding in token
Validate SecurityScopes configuration
Supabase Connection Failed:
Verify SUPABASE_URL and SUPABASE_KEY
Check project settings in Supabase dashboard
Validate network connectivity
Protected Routes Pattern Example: examples/protected_routes.py
@app.get("/"
async def root ():
return {"message" : "Public endpoint" }
@app.get("/users/me"
async def read_users_me (current_user: User = Depends(get_current_user ) ):
return current_user
@app.post("/items/"
async def create_item (
item: Item,
current_user: User = Security(get_current_active_user, scopes=["items:write" ] )
):
return create_item_for_user(current_user, item)
@app.delete("/users/{user_id}"
async def delete_user (
user_id: int ,
current_user: User = Depends(get_current_admin_user )
):
return delete_user_by_id(user_id)
Permission System Pattern Example: examples/permission_system.py
Role-Based Access Control (RBAC):
class Role (str , Enum):
ADMIN = "admin"
USER = "user"
GUEST = "guest"
class User (BaseModel ):
username: str
role: Role
permissions: List [str ]
def has_permission (user: User, required_permission: str ) -> bool :
if user.role == Role.ADMIN:
return True
return required_permission in user.permissions
async def require_permission (permission: str ):
async def permission_checker (current_user: User = Depends(get_current_user ) ):
if not has_permission(current_user, permission):
raise HTTPException(403 , f"Permission '{permission} ' required" )
return current_user
return permission_checker
@app.delete("/items/{item_id}"
async def delete_item (
item_id: int ,
current_user: User = Depends(require_permission("items:delete" )
):
return delete_item_by_id(item_id)
Best Practices
Never store passwords in plaintext
Use Argon2 for password hashing (recommended over bcrypt)
Store SECRET_KEY in environment variables (never commit)
Use HTTPS in production
Implement rate limiting on login endpoints
Add token refresh mechanism for long sessions
Short access token expiration (15-30 minutes)
Long refresh token expiration (7-30 days)
Rotate refresh tokens on use
Implement token revocation list for logout
Use hierarchical scopes (e.g., items, items:read, items:write)
Follow least-privilege principle
Document all scopes in OpenAPI
Validate scopes on every request
Return 401 for authentication failures
Return 403 for authorization failures
Include WWW-Authenticate header with 401
Log authentication attempts for security monitoring
Dependencies pip install fastapi
pip install python-jose[cryptography]
pip install pwdlib[argon2]
pip install supabase
SECRET_KEY=your_secret_key_here
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=30
# For Supabase
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your_anon_key
Supported Auth Strategies: JWT, OAuth2 Password Flow, OAuth2 Scopes, Supabase
Version: 1.0.0
FastAPI Compatibility: 0.100+
