Package: fastapi-auth2
fastapi_auth2API key based Authentication package for FastAPI, focused on simplicity and ease of use:Full functionality out of the box, no configuration requiredAPI key security with localsqliteorpostgresdatabase backend, working with both header and query parametersDefault 15 days deprecation for generated API keysKey creation, revocation, renewing, and usage logs handled through administrator endpointsUsername, Email address and password(hashing + salting) verification features.Lightweight, minimal dependencies required.UpdatesAddedpartialsupport for mongodb database backend.Added support for environment variables through .env files.Addedexample.envfile to show how to use environment variables.UpdatedREADME.mdto reflect changes.Updated documentation to reflect changes.Working on adding support formysqldatabase backend.Installationpip install fastapi_auth2UsageCreating an applicationfromfastapiimportDepends,FastAPIfromfastapi_authimportapi_key_router,api_key_securityapp=FastAPI(description="FastAPI Auth is a package that provides authentication based API security with FastAPI and Postgres Database, SQLite Database or MongoDB Database",title="FastAPI Auth Example",version=1.0,)app.include_router(api_key_router,prefix="/auth",tags=["_auth"])@app.get("/unsecure")asyncdefunsecure_endpoint():return{"message":"This is a unsecure endpoint"}@app.get("/secure",dependencies=[Depends(api_key_security)])asyncdefsecure_endpoint():return{"message":"This is a secure endpoint"}Resulting app is:API key creation through docsStart your API and check the logs for the automatically generated secret key if you did not provide one through
environment variables.Go to/docson your API and inform this secret key in theAuthorize/Secret headerbox.
All the administrator endpoints only support header security to make sure the secret key is not inadvertently
shared when sharing an URL.Then, you can use/auth/newto generate a new API key.And finally, you can use this API key to access the secure endpoint.API key creation in pythonYou can of course automate API key acquisition through python withrequestsand directly querying the endpoints.If you do so, you can hide the endpoints from your API documentation with the environment variableFASTAPI_AUTH_HIDE_DOCS.ConfigurationEnvironment variables:FASTAPI_AUTH_SECRET: Secret administrator keyGenerated automatically on server startup if not providedAllows generation of new API keys, revoking of existing ones, and API key usage viewIt being compromised compromises the security of the APIFASTAPI_AUTH_HIDE_DOCS: Whether or not to hide the API key related endpoints from the documentationFASTAPI_AUTH_DB_LOCATION: Location of the local sqlite database filesqlite.dbin the running directory by defaultWhen running the app inside Docker, use a bind mount for persistenceFASTAPI_AUTH_AUTOMATIC_EXPIRATION: Duration, in days, until an API key is deemed expired15 days by defaultDATABASE_MODE: If set topostgres, the package will use a postgres database instead of sqliteURI: Location of the postgres databasepostgresql://postgres:postgres@localhost:5432/postgresby defaultOnly used ifDEV_MODEis set toFalseContributingSeeCONTIBUTING.mdfor more information.Setting up python environmentpoetryinstall
poetryshellSetting up pre-commit hookspre-commitinstallRunning testspytestRunning the dev environmentThe attached docker image runs a test app onlocalhost:8080with secret keyTEST_SECRET. Run it with:docker-composebuild&&docker-composeupTODOAdd more testsAdd more database backendsAdd more authentication methods