FastAPI Authentication with JWT (JSON Web Tokens)

[@carlosvelazquez7979]

Wooo, what a great great Video !!!!!, Excellent I do appreciate it !!!, I've been developing softWare for 40 years ( since I was 14 ), few videos like this one !!, and I've watched lots !!!

[@BekBrace]

Thank you very much for such kind words 🙏🙂

[@MohamedBadr-xc7xq]

Great tutorial man, no animation or crazy graphics, just intelligent man explaining programming! Hats off to you brother

[@BekBrace]

Thank you very much

[@juanmanero4631]

you are the FASTAPI king of youtube , man !!

[@BekBrace]

hehe - Thanks for the compliment :)

[@juanmanero4631]

@@BekBrace the truth ma man

[@marcus7387]

Friday night tutorial! Thank you Bek, great work

[@BekBrace]

Thank you

[@marcus7387]

@@BekBrace please can you make tutorial on FastAPI and machine learning?

[@BekBrace]

@@marcus7387 sure, it’s doable 🙂

[@luizferez89]

Amazing , thanks a lot I was waiting FastAPI, thank you for answering the request, you really deserve more views

[@BekBrace]

Thank you

[@gerardmunoz6075]

Thanks Bek Brace for great tutorial, it was difficult for me as beginner, but I learned a few things too and will continue to learn fastapi because it's the best

[@BekBrace]

Glad to hear that - thanks for watching

[@DeepakTandale-z9f]

Hey, Bek have just subscribed your channel for developing & learning software skiils, I like your teaching skills that there is silent background music with your slowly teaching techniques & explanation + hands-on. your videos on Django is on of the great Tutorial for me ...! Thanks man...

[@BekBrace]

Thank you! Stay sharp and good luck to your programming journey, man

[@shamansharif]

Just subscribed. This helped me a lot. I can't thank you enough. Love from Bangladesh.

[@BekBrace]

Tha k you my friend, I appreciate your support to the channel

[@lfcamacho]

great video! as mentioned before by other people, the only issue with this, is the authorization at the end... you can simply type any key instead of the generated token, even a single character and it will grant you access to the Post method. How can we make sure the entered token is the same one we generated?

[@rahulsharma-cb7kk]

Yes that's the problem the route are not authenticated anyone can access it

[@pawelsb]

Awesome quality content as always, keep it up Bek ✨

[@BekBrace]

Thanks so much Pawel 🙂 🙏

[@uncountableuk]

great video Bek. Super clear to follow all the steps

[@BekBrace]

Thank you very much, Chris 🙏

[@DevBishwasBh]

Wow, you already have an awesome tutorial on FastAPI Authentication. I am waiting for a tutorial on integrating it with Next Js [possible with Next Auth].

[@BekBrace]

There will be :)

[@DevBishwasBh]

​@@BekBrace Great! That tutorial will begin my renewed webdev journey with FastAPI and Next Js. Thanks for the efforts 😊

[@MuhammedBasil]

Amazing Tutorial. Crisp and Clear. Thank you !.

[@BekBrace]

Thank you so much Mohamed - Happy Ramadan to you

[@MuhammedBasil]

@@BekBrace i just tried the same now. No hiccups, very easy to follow. Thanks again mate. Happy Ramadan to you too.

[@MycalA-z7j]

Thank you man,it was a nice one,really learnt and understood what i was working on

[@BekBrace]

Thank you very much, my friend

[@davidmiricho385]

Great video on FAST API. Loving it

[@BekBrace]

Thank you so much, David

[@vini_yz]

Really great tutorial man! It helped me a lot. Thanks for the content

[@BekBrace]

Good to hear my friend

[@JemilMarcosTyC]

Thanks a lot! very helpfull, BUT, if I try this on postman, no matter what string I put on Authorization it will bypass security and let me post... I also added the retraint to be a token bearer to even list the penguins, tigers and stuff and it let me through

[@BekBrace]

I am aware of the issue, once i have the time i will check out deeper and write the solution in the description - thanks for the heads-up though

[@m_muhd]

This is what I have been looking for thank you

[@yura2110]

keep going ! this was a really clean video !!

[@BekBrace]

Thank you so much Yura !

[@apexyu164]

why you need to add Body(default = None) line 66 in 39:55 ? whats the purpose of that ?

[@BekBrace]

Really nothing more than showing how a standard template. You can omit it and it will still work.

[@pramudyadika_]

thanks! ur explanation is crystal clear!

[@BekBrace]

Thank you very much 🙂

[@АртемЕршов-р9е]

Это отличное видео! Всё чётко и подробно!

[@BekBrace]

Огромное тебе спасибо, друг 🙏

[@monasser6]

Great course, thank you Bek Brace

[@BekBrace]

Thank You

[@sziller_eu]

In the last step, does it give an error if I slightly change the token pasted? Also how can I read data from the token once inside a function?

[@michaelehrenreich]

Excellent, I enjoyed this video very much!

[@BekBrace]

Thank you very much 🙏☺️ Always glad to receive such feedback 🙏

[@guruyaya]

Nice tutorial. There's one thing I didn't get: on def user_signup(user: UserSchema = Body(default=None)): - I tried it without the Boy default value, and it worked just the same. What's the use of the Body default value there? Thanks in advance

[@BekBrace]

Hey Yair thanks for your comment. You can delete the default if you want to keep it simple with no extra arguments, that’s why you’ll have the same result; however if the userschema body is set to be a different default value, it will behave differently. I just put it to be visually clear if anyone wants to change the default value.

[@guruyaya]

@@BekBrace so this helps me to set the default behavior, if no json is sent. Got it.

[@hritikcodes876]

hey i don't understand the use of Config class in Schemas, can you please explain the benefit of adding Config class in a Schema?

[@georgesamuel3774]

Great turtorial bro , keep it up ❤️❤️

[@BekBrace]

Thank you 🙏

[@avinashpatel6745]

Hello sir, thank you for great tutorial can you please show in other video how to show this with a frontend framework instead of showing in postman or fastapi swagger ? very good explanation, i believe you deserve more views. Regards from Pune, India

[@BekBrace]

Thank you so much Avinash , your words mean a lot really. It’s an awesome idea, I can make a FastAPI Vue tutorial with JWT authentication - just added this to the three months plan for channels vids. Thanks 😊

[@avinashpatel6745]

@@BekBrace Thank you sir for responding. God bless you

[@mawe4585]

Thanks for the tutorial. Sadly all tutorial about JWT and Authorization in general for FastAPI, leave out the part where you use the user-information in later calls. Like adding the author of the blog-post in this example.

[@LearnWithAshiii]

You have Done a Great Job respect from Pakistan ❤

[@BekBrace]

Thank you very much 🙏😊

[@jdratlif]

JWTs have built-in expiration times. Why did you make a custom field? pyJWT will throw an exception for expired token.

[@BekBrace]

I think I was trying to add more logic, but you’re right it would’ve been better to keep it simple and leave it to pyjwt to handle it 😁

[@ndreuh]

Great video! Say, why do you set Schema = Body() in some functions, what's that for?

[@BekBrace]

For standardization purposes nothing more

[@amandubey5287]

Thank you so much for this, you gained a sub

[@BekBrace]

Thank you so much my friend

[@portiseremacunix]

Thanks. I have the 403 error at the last stage to test the JWT bearer. Can I see the source code somewhere?

[@BekBrace]

Hi Kirby, thanks for commenting Yes, I've added it in the description. Here's the link: github.com/BekBrace/FASTAPI-and-JWT-Authentication

[@kz_cbble9670]

Even if i post the wrong acces token in authorize , it still allows me to post.. what's wrong?

[@AcezeroGame]

I had same issue and turns out we forgot to add verify_jwt in jwt_bearer file. Simply add an if statement below if not credentials statement. Just check if not self.verify_jwt with credentials.credentials.

[@jimlyjimlesson4502]

Hi Bek, thanks fr ur lesson. very interesting and a very good speak! But i have an problem and can't find it. If i tried to enter the post with Dependencies, i get alwyas an Error: jwt_bearer.py", line 17, in __call__ raise credentials.credentials TypeError: exceptions must derive from BaseException

[@BekSteps]

What dependencies are you trying to post with ?

[@superspamtube7464]

After finishing this video my login route doesnt work. But the signup works and I can POST new blog posts and get all and get one post works. I have a import error "Import jwt could not be resolved". I know this video is one year old but maybe you can assist with that.

[@BekBrace]

I will do my best finding the solution 🙂

[@jordixboy]

how would u get user_id from the jwt in the controller?

[@jnone2488]

what is the differences between JWT, JOT and access token ? I will wait for the answers pls. Thanks!

[@BekBrace]

Hello my friend. Sure. JWT (JSON Web Token) and JOT (JSON Object Token) are both types of access tokens used for authorization and authentication, while access token is a more general term used for any token that grants access to a protected resource.

[@sawojarianski6991]

How do You placed sample data "Tiger, Koala, etc. " , Is this a special addon for that functionality ?

[@BekBrace]

But it's clear how i did it in the tutorial

[@TusharBhut-mk6mn]

Can you make video on different authentication for both user and admin, Where user authorized can only use [GET] method, while admin authorized can use all the method [crud] ?

[@BekBrace]

Sure

[@kiransingh2935]

How does fastAPI know to call the verify_jwt function on the handler? Is that some special baked in logic?

[@BekBrace]

Exactly that

[@b20lopez]

Hi Bek! I am looking for "API KEYS" You know, a key I can provide to customers to they communicate to the backend. I need API keys to deduct credits from their account. Is that the same API KEYS I am looking for? Where I just have to remove the Expiration? I watch a video that API keys can be sniffed.. so I wonder if this is the same API key i am looking to implement

[@BekBrace]

I'll look into this and get back to you

[@orlanino]

What about authorization, please? Also how do you propagate the authentication and authorization to backend microservices?

[@htwray]

HI Bek Brace, this is an excellent tutorial. I am very new in using JWT authentication. Just want to know if there are any token refresh mechanism in pyjwt package? Or any other recommendation on the token refresh ? Thanks in advance!

[@BekBrace]

Hey 😊👋 thanks for your comment I'm pretty sure there are, I'm gonna check that and be back to you with an answer to your question

[@htwray]

Thank you for your help! I will also study for it.

[@kadiryaren5564]

just one word! Perfect!

[@BekBrace]

Thank you very much

[@kriskrawiec5513]

Thanks man, very helpful

[@BekBrace]

You're very welcome

[@startmusicworld666]

Hello Sir, I got this error can u provide solution for this ----->JWT_SECRET = config("secret"), raise UndefinedValueError('{} not found. Declare it as envvar or define a default value.'.format(option)) decouple.UndefinedValueError: secret not found. Declare it as envvar or define a default value.

[@BekBrace]

Ok, maybe you can download the source code and check out what went wrong? This way you will teach yourself while taking notes ☺️

[@MaxoSall]

I have yet to see any tutorials about actual atheoriaztion and permissions in fastapi

[@BekBrace]

You're welcome

[@md.redwanhossain6288]

can you kindly cover refresh token and token blacklisting in another video?

[@BekBrace]

Sure 😊

[@johnniefujita]

it is important to mention that on that category the fastest frameworks are around 6x faster than fastapi. But it is indeed fast enough and very fast for python. I have been working in companies migrating their services for fastapi from django and flask mainly

[@BekBrace]

Oh 6x faster 😯 ? Thanks for the information, Johnnie.

[@davidcostigan8816]

interesting

[@erjiaxiao6577]

Hi Johnnie, so you mean fastest framework in Java and Go etc. ?

[@johnniefujita]

@@erjiaxiao6577 yes... java, go, rust, c++ and even node frameworks are faster. But we are usually bounded by other factors when dealing with rest api backend servers. So that does not really become a decision factor. At least.

[@erjiaxiao6577]

@@johnniefujita I see.. I check some benchmark and find that python nowadays could has its position with these contestants. good news for those who like python. thank you for the info!

[@MycalA-z7j]

hi bek,if i want to update user information using PUT method of a specific user,how can i use the token that was generated in login and user the same token in PUT method to represent that same user and update only the details of that specific user

[@BekBrace]

Hey, thank you for this question :) Actually, you can update user information using the PUT method for a specific user by the following: 1- Token-Based Authentication: Set up token-based authentication in your FastAPI application. When a user logs in successfully, generate a JWT token and return it to the client. The client should store this token securely. 2- Protect Routes: Protect the routes or endpoints that require authentication and user information updates. Only authenticated users with valid JWT tokens should be able to access these routes. 3- Client-Side: When making a PUT request to update user information, include the JWT token in the request header as an "Authorization" header with the "Bearer" prefix: Authorization: Bearer As far as thee Server-Side (FastAPI), you need to: 1- Authenticate the user: Verify that the provided JWT token is valid and decode it to extract the user's identity (usually the user's ID). 2- Authorize the update: Ensure that the user making the request has the necessary permissions to update the user information. Typically, users can only update their own information, so you should check if the user ID extracted from the token matches the user being updated. 3- Update the user information: If authentication and authorization checks pass, proceed to update the user's information in your database based on the data provided in the PUT request.

[@mycala6]

Can anyone help me out. I have one doubt suppose you have 2 users (student and admin)how to use the generated token during login, only for the student specified tag user I logged in and it's methods and that token should not be able to be used by the admin methods, To perform operations on admin again we need to create token for that.

[@BekBrace]

Hey! You can try to implement role-based access control (RBAC) in your authentication and authorization system for the student and the admin, each of which will have separate tokens and permissions.

[@lerealiste3338]

It’s doesn't work. It's getting access to post with random symbols instead token.

[@BekBrace]

It should work, this is odd. Do you have an error message ?

[@razapanjwani6502]

How does the server tell client side that a user is logged in?

[@piuskariuki5295]

This is friggin AWESOME

[@BekBrace]

Thank you so much 🙂🙏

[@josetuc]

It's a great tutorial, but... HOUSTON WE HAVE A PROBLEM =(( : when I added dependencies=[Depends(jwtBearer())]... In my console I can read this error: TypeError: HTTPBearer.__init__() got an unexpected keyword argument 'auto_Error'... Could you help me please? Thanks a lot

[@BekBrace]

Hey Gomez 👋 I’ll check it out and will be back to you with an answer to this issue

[@josetuc]

@@BekBrace thanks a lot my dear friend, you're the Best!!!

[@alexandere9723]

@@BekBrace write is small, auto_error = auto_Error

[@saibademais]

I enjoyed a lot. Thanks

[@BekBrace]

Thank you, Ricardo!

[@basilihuoma5300]

This is super cool, thanks.

[@BekBrace]

Thanks my friend

[@jasenmackie1028]

Thanks for the video. Is the code available anywhere? I could not get the token on user signup and not sure why. Would like to compare my code. Thanks!

[@BekBrace]

Hey Jasen, thanks for commenting. Yes, I've added the source code in the description. Here's the link: github.com/BekBrace/FASTAPI-and-JWT-Authentication

[@DevArjun]

Sir How To Add Current User With Post as well like post : 1, title: snakes, text: they are cool, author: current_user

[@dab_tube]

Easy clear and concise

[@BekBrace]

Thank you very much

[@jcpalumboai1]

Great video! Thanks

[@BekBrace]

I'm glad 🙂

[@yashgajewar9019]

I followed the tutorial but whenever I try to post data I get an error that token is invalid has anyone faced the same issue??

[@dogaada6619]

Hello sir, thanks for great tutorial. I would like to ask you about jwtBearer Process. I applied your code in another project but the problem is which value I entered to jwtBearer is not important to authorize the endpoint. I would like to secure my public endpoint with verify_token. Also I created /login endpoint and after a username and password process for authenticate I can get access_token. As I mentioned in above, I would like to use this access_token to authorize in different public endpoints. Would you help me about it?

[@BekBrace]

Sure i can help. you can use this access_token for auth in different public endpoints. How do you want to start?

[@dogaada6619]

I would like asking about I can secure with token the endpoints ok but the problem is instead of access_token with any value which I enter the authentication point I can authorize the endpoint. Normally I think I have to give an acces_token which I get from the login endpoint, after that I can be authorised the post method which is secured with token. So I confused about that how I could secure with only access_token not any value. Also I looked into source code of you shared, when I apply it to my project. I cannot authorize with access_token and any value

[@ickynho7]

@@dogaada6619 simply add new field key value like role: admin, and a condition if its admin then allow.

[@mjavint]

great course my friend

[@BekBrace]

Thank you very much my friend

[@jeanleloup2205]

Thank you for the tutorial it was very good. What about put and delete requests ? Thank you

[@BekBrace]

Thanks Jean The same as we post, follow the same rules , and as for creating the routes you can check out my FastAPI course, you’ll find your answer there

[@BestChan2610]

Can you help integrate this into a frontend framework like Svelte?

[@BekBrace]

Don't have much experience with Svelte, sorry

[@enchance]

Can you do a video on the FastAPI Users package with Google Auth? I think having OAuth2 authentication is something people are really after because of its ease of use.

[@BekBrace]

Yes, i will do that with oauth2 soon

[@enchance]

@@BekBrace Awesome! Will be looking out for it.

[@도현김-x4n]

The api works even though it is not an issued token. I do not know the reason. why...??

[@BekBrace]

It should work for reading [Get] verb, but not for writing [POST] - is that the case ?

[@도현김-x4n]

@@BekBrace Both [post] and [get] are the same case.

[@wihanuys]

Hi @BekBrace, I use this tutorial, but I can enter any string in the authorize window in FastAPI docs and it will accept it as a valid authentication. there must be an error somewhere in the video, could you please verify it

[@BekBrace]

Ok

[@wihanuys]

@@BekBrace Thank you, I copied it excatly, but I can enter any string, into the authorization window, even if it is not a JWT token, and I have access to all the protected routes

[@mehul4mak]

@21.24 how come you are getting I'd 4 and 5 if you are posting Id 0?

[@BekBrace]

Great question. The id 0 in the curl link doesn't necessarily mean the actual id number of the item added, it starts at 0 and increments based on previously added items, in this case as explained I've added cats twice, that's why the GET request showed it twice at I'd 4 and 5.

[@amarek5841]

Very nice 👍 thanks for the good job

[@BekBrace]

Thanks 🙏

[@CodingByAmp]

thank you , follower

[@BekBrace]

thank you for watching

[@amandubey5287]

I just have two questions like why are we putting 1) why are we doing this decoded_token["expiry"] >= time.time() 2)Why are we returning the tokens via signJWT() method two times one time via signup and the other time via signup, can you explain that to me

[@BekBrace]

Thanks for your questions, my friend. Answering your questions: 1- The decodeJWT function takes the token and decodes it with the aid of the jwt module and then stores it in a decoded_token variable. So what we want is to return decoded_token if the expiry time is valid which is exactly the answer to your question, otherwise, we return None. 2- In signup, I returned signJWT only once not twice : @app.post("/user/signup", tags=["user"]) async def create_user(user: UserSchema = Body(...)): users.append(user) return signJWT(user.email)

[@earvinjamesdantes5800]

How will I implement the register with a confirm password?

[@BekBrace]

With a very simple conditional to check if the pass entered 2nd time == 1st time, then continue; else raiseerror (not identical password ) - that’s the main idea, I’m sure you can search for the syntax

[@earvinjamesdantes5800]

@@BekBrace Ohhhhh I thought you're gonna have to create like a new schema/model with the confirmationPassword as its field. Thank youuuuu!

[@AiF0]

Man can you give me your keyborad's name and great video

[@BekBrace]

Thank you my friend. Keyboard's name is Genesis Thor 300

[@devpriyashivani1855]

Tried multiple times but finally got the error: { "detail": "Invalid token or expired token." }

[@BekBrace]

Oh sorry to hear that, but I can advise you to make sure that your JWT token you are using for authentication is valid and has not expired, make sure to generate a new token if the existing one has expired.

[@ahmedqassem4326]

Thanks man!

[@BekBrace]

Welcome :)

[@ahmedqassem4326]

@@BekBrace can fastapi be integrated with another language ?

[@alwaysdjango]

Pls how do we identify the authenticated user??

[@BekBrace]

what do you mean by "identify" ?

[@alwaysdjango]

@@BekBrace Like how do you get the authenticated users credenttials from the secured routes.

[@carlosvelazquez7979]

I found how to verify the correct token within this code

[@phatvo2739]

can you help me doc about authen with social media

[@BekBrace]

What’s happening ?

[@tanjimulislam4762]

Thank you!

[@BekBrace]

You are very welcome 🙂

[@STEFFIGEORGE-tw8wz]

Thank you so much!!!!

[@BekBrace]

You're welcome 🤗

[@arknexter]

Link to github doesn't work

[@BekBrace]

It is working fine

[@arknexter]

Strange. Now it works

[@bebomohamed8860]

thanks alot 🌹🌹

[@BekBrace]

You're welcome 😊

[@narutokun5093]

👏 👏 👏 👏 👏 👏

[@BekBrace]

Thank you :)

[@mr.deep.]

Thanks

[@BekBrace]

Thank You

[@vfb6265]

You miss this code in jwtBearer Class : async def __call__(self, request: Request): [...] if credentials: [....] if not self.verify_jwt(credentials.credentials): raise HTTPException(status_code=403, detail="Message here !") return credentials.credentials else: raise HTTPException(status_code=403,detail="Message here !")

[@BekBrace]

Cheers

[@kz_cbble9670]

37:46

[@BekSteps]

?

[@BekBrace]

Ok .. what ?

[@kz_cbble9670]

@@BekBrace sorry i should have added a ignore message.. these are just timestamps for my use

[@امینجمالی-خ9ص]

i wish it was more deep

[@BekBrace]

It's as deep as it gets 😉

[@keycume]

Great!

[@BekBrace]

Thank you

[@Alexey-f7d]

Thanks

[@BekBrace]

Thank you!