Package: fastapi-sqlmodel-security
FastAPI Simple Security via SQLModel(This is forked fromFastAPI Simple Securitywith an SQLModel adaption. Credits to the original author!)API key based security package for FastAPI, focused on simplicity of use:Full functionality out of the box, no configuration requiredAPI key security with localsqlitebackend, working with both header and query parametersDefault 15 days deprecation for generated API keysKey creation, revocation, renewing, and usage logs handled through administrator endpointsNo dependencies, only requiringFastAPIand the python standard libraryThis module cannot be used for any kind of distributed deployment. It's goal is to help have some basic security features
for simple one-server API deployments, mostly during development.Installationpip install fastapi_sqlmodel_securityUsageCreating an applicationThe key is to configure an instance ofdata store, which can usually be done withSqlModelDataStoreas shown below.fromfastapi_sqlmodel_securityimportcreate_auth_router,ApiKeySecurity,DataStore,SqlModelDataStorefromfastapiimportDepends,FastAPIapp=FastAPI()data_store=SqlModelDataStore(conn_url="sqlite3:///keys.db")app.include_router(create_auth_router(data_store),prefix="/auth",tags=["_auth"])@app.get("/secure",dependencies=[Depends(ApiKeySecurity(data_store))])asyncdefsecure_endpoint():return{"message":"This is a secure endpoint"}Both the auth router and your own routes would need dependencies to be configured with the aforementioned data store.Resulting app is:More can be found in thedemo app.API key creation through docsStart your API and check the logs for the automatically generated secret key if you did not provide one through
environment variables.Go to/docson your API and inform this secret key in theAuthorize/Secret headerbox.
All the administrator endpoints only support header security to make sure the secret key is not inadvertently
shared when sharing an URL.Then, you can use/auth/newto generate a new API key.And finally, you can use this API key to access the secure endpoint.API key creation in pythonYou can of course automate API key acquisition through python withrequestsand directly querying the endpoints.If you do so, you can hide the endpoints from your API documentation with the environment variableFASTAPI_SQLMODEL_SECURITY_HIDE_DOCS.TestingYou may want to use ano-authapi key security filterNoAuthApiKeySecurityas an alternative to the real filter.It does not do any key verification and will never block any requests, as long as they carry an API key of any value.ConfigurationEnvironment variables:FASTAPI_SQLMODEL_SECURITY_SECRET: Secret administrator keyGenerated automatically on server startup if not providedAllows generation of new API keys, revoking of existing ones, and API key usage viewIt being compromised compromises the security of the APIFASTAPI_SQLMODEL_SECURITY_HIDE_DOCS: Whether or not to hide the API key related endpoints from the documentationFASTAPI_SQLMODEL_SECURITY_AUTOMATIC_EXPIRATION: Duration, in days, until an API key is deemed expired15 days by defaultContributingSetting up python environmentpoetryinstall
poetryshellSetting up pre-commit hookspre-commitinstallRunning testspytestRunning the dev environmentThe attached docker image runs a test app onlocalhost:8080with secret keyTEST_SECRET. Run it with:docker-composebuild&&docker-composeupNeeded contributionsMore options with sensible defaultsLogging per API key?More back-end options for API key storage?