Implement and validate FastAPI authentication strategies including JWT tokens, OAuth2 password flows, OAuth2 scopes for permissions, and Supabase integration. Use when implementing authentication, securing endpoints, handling user login/signup, managing permissions, integrating OAuth providers, or when user mentions JWT, OAuth2, Supabase auth, protected routes, access control, role-based permissions, or authentication errors.
Implements and validates FastAPI authentication strategies including JWT, OAuth2 flows with scopes, and Supabase integration. Activates when securing endpoints, handling login/signup, managing permissions, or fixing authentication errors (401/403).
/plugin marketplace add vanman2024/ai-dev-marketplace/plugin install fastapi-backend@ai-dev-marketplaceThis skill is limited to using the following tools:
README.mdexamples/permission_system.pyexamples/protected_routes.pyscripts/setup-jwt.shscripts/validate-auth.shtemplates/jwt_auth.pytemplates/oauth2_flow.pytemplates/supabase_auth.pyPurpose: Autonomously implement, validate, and debug FastAPI authentication systems with multiple strategies.
Activation Triggers:
Key Resources:
scripts/setup-jwt.sh - Initialize JWT authentication systemscripts/validate-auth.sh - Validate authentication configurationtemplates/jwt_auth.py - Complete JWT authentication implementationtemplates/oauth2_flow.py - OAuth2 password flow with scopestemplates/supabase_auth.py - Supabase integration for FastAPIexamples/protected_routes.py - Protected endpoint patternsexamples/permission_system.py - Role and permission-based accessUse When:
Setup:
./scripts/setup-jwt.sh
Core Components:
Implementation Pattern:
# Hash passwords (never store plaintext)
password_hash = PasswordHash.recommended()
hashed = password_hash.hash(plain_password)
# Generate JWT token
def create_access_token(data: dict, expires_delta: timedelta):
to_encode = data.copy()
expire = datetime.now(timezone.utc) + expires_delta
to_encode.update({"exp": expire})
return jwt.encode(to_encode, SECRET_KEY, algorithm="HS256")
# Validate token and extract user
async def get_current_user(token: str = Depends(oauth2_scheme)):
payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
username = payload.get("sub")
return get_user(username)
Key Points:
Use When:
Template: templates/oauth2_flow.py
Flow:
OAuth2PasswordRequestFormSecurity Scheme:
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
@app.post("/token")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
user = authenticate_user(form_data.username, form_data.password)
access_token = create_access_token(data={"sub": user.username})
return {"access_token": access_token, "token_type": "bearer"}
Use When:
Template: See templates/oauth2_flow.py (includes scopes)
Define Scopes:
oauth2_scheme = OAuth2PasswordBearer(
tokenUrl="token",
scopes={
"me": "Read information about current user",
"items": "Read items",
"items:write": "Create and modify items"
}
)
Encode Scopes in Token:
# During login, add user's scopes to token
token_data = {"sub": username, "scopes": user.scopes}
access_token = create_access_token(token_data)
Protect Endpoints with Scopes:
async def get_current_user(
security_scopes: SecurityScopes,
token: str = Depends(oauth2_scheme)
):
# Validate token has required scopes
for scope in security_scopes.scopes:
if scope not in token_data.scopes:
raise HTTPException(401, "Not enough permissions")
@app.get("/users/me/items/")
async def read_items(
current_user: User = Security(get_current_active_user, scopes=["items"])
):
return current_user.items
Use When:
Template: templates/supabase_auth.py
Setup:
from supabase import create_client, Client
supabase: Client = create_client(
os.getenv("SUPABASE_URL"),
os.getenv("SUPABASE_KEY")
)
Sign Up:
# Email/password signup
response = supabase.auth.sign_up({
"email": "user@example.com",
"password": "secure_password",
"options": {"data": {"full_name": "John Doe"}}
})
Sign In:
response = supabase.auth.sign_in_with_password({
"email": "user@example.com",
"password": "secure_password"
})
access_token = response.session.access_token
Validate Token in FastAPI:
async def get_current_user(token: str = Depends(oauth2_scheme)):
# Validate Supabase JWT token
user = supabase.auth.get_user(token)
return user
Integration Pattern:
./scripts/validate-auth.sh
Checks Performed:
Missing SECRET_KEY:
# Generate secure random key
openssl rand -hex 32
# Add to .env
echo 'SECRET_KEY=your_generated_key' >> .env
Token Expired (401):
Invalid Credentials:
Missing Permissions (403):
Supabase Connection Failed:
Example: examples/protected_routes.py
# Public endpoint (no auth)
@app.get("/")
async def root():
return {"message": "Public endpoint"}
# Protected endpoint (requires authentication)
@app.get("/users/me")
async def read_users_me(current_user: User = Depends(get_current_user)):
return current_user
# Protected with specific permission
@app.post("/items/")
async def create_item(
item: Item,
current_user: User = Security(get_current_active_user, scopes=["items:write"])
):
return create_item_for_user(current_user, item)
# Admin-only endpoint
@app.delete("/users/{user_id}")
async def delete_user(
user_id: int,
current_user: User = Depends(get_current_admin_user)
):
return delete_user_by_id(user_id)
Example: examples/permission_system.py
Role-Based Access Control (RBAC):
class Role(str, Enum):
ADMIN = "admin"
USER = "user"
GUEST = "guest"
class User(BaseModel):
username: str
role: Role
permissions: List[str]
def has_permission(user: User, required_permission: str) -> bool:
# Admins have all permissions
if user.role == Role.ADMIN:
return True
return required_permission in user.permissions
async def require_permission(permission: str):
async def permission_checker(current_user: User = Depends(get_current_user)):
if not has_permission(current_user, permission):
raise HTTPException(403, f"Permission '{permission}' required")
return current_user
return permission_checker
# Usage
@app.delete("/items/{item_id}")
async def delete_item(
item_id: int,
current_user: User = Depends(require_permission("items:delete"))
):
return delete_item_by_id(item_id)
Security:
Token Management:
Scope Design:
Error Handling:
Required Packages:
pip install fastapi
pip install python-jose[cryptography]
pip install pwdlib[argon2]
pip install supabase # If using Supabase
Environment Variables:
SECRET_KEY=your_secret_key_here
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=30
# For Supabase
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your_anon_key
Supported Auth Strategies: JWT, OAuth2 Password Flow, OAuth2 Scopes, Supabase
Version: 1.0.0 FastAPI Compatibility: 0.100+
Use when working with Payload CMS projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.