* [ Encoders - ` jsonable_encoder ` ](../../../reference/encoders/)
    * [ Static Files - ` StaticFiles ` ](../../../reference/staticfiles/)
    * [ Templating - ` Jinja2Templates ` ](../../../reference/templating/)
    * [ Test Client - ` TestClient ` ](../../../reference/testclient/)
  * [ FastAPI People  ](../../../fastapi-people/)
  * [ Resources  ](../../../resources/)

Resources

    * [ Full Stack FastAPI Template  ](../../../project-generation/)
    * [ External Links and Articles  ](../../../external-links/)
    * [ FastAPI and friends newsletter  ](../../../newsletter/)
  * [ About  ](../../../about/)

About

    * [ Alternatives, Inspiration and Comparisons  ](../../../alternatives/)
    * [ History, Design and Future  ](../../../history-design-future/)
    * [ Benchmarks  ](../../../benchmarks/)
  * [ Help  ](../../../help/)

Help

    * [ Help FastAPI - Get Help  ](../../../help-fastapi/)
    * [ Development - Contributing  ](../../../contributing/)
  * [ Release Notes  ](../../../release-notes/)

Table of contents

  * Get the ` username ` and ` password `
    * ` scope `
  * Code to get the ` username ` and ` password `
    * ` OAuth2PasswordRequestForm `
    * Use the form data 
    * Check the password 
      * Password hashing 
        * Why use password hashing 
      * About ` **user_dict `
  * Return the token 
  * Update the dependencies 
  * See it in action 
    * Authenticate 
    * Get your own user data 
    * Inactive user 
  * Recap 

  1. [ FastAPI  ](../../..)
  2. [ Learn  ](../../../learn/)
  3. [ Tutorial - User Guide  ](../../)
  4. [ Security  ](../)

#  Simple OAuth2 with Password and Bearer  ¶

Now let's build from the previous chapter and add the missing parts to have a
complete security flow.

##  Get the ` username ` and ` password ` ¶

We are going to use **FastAPI** security utilities to get the ` username ` and
` password ` .

OAuth2 specifies that when using the "password flow" (that we are using) the
client/user must send a ` username ` and ` password ` fields as form data.

And the spec says that the fields have to be named like that. So ` user-name `
or ` email ` wouldn't work.

But don't worry, you can show it as you wish to your final users in the
frontend.

And your database models can use any other names you want.

But for the login _path operation_ , we need to use these names to be
compatible with the spec (and be able to, for example, use the integrated API
documentation system).

The spec also states that the ` username ` and ` password ` must be sent as
form data (so, no JSON here).

###  ` scope ` ¶

The spec also says that the client can send another form field " ` scope ` ".

The form field name is ` scope ` (in singular), but it is actually a long
string with "scopes" separated by spaces.

Each "scope" is just a string (without spaces).

They are normally used to declare specific security permissions, for example:

  * ` users:read ` or ` users:write ` are common examples. 
  * ` instagram_basic ` is used by Facebook / Instagram. 
  * ` https://www.googleapis.com/auth/drive ` is used by Google. 

Info

In OAuth2 a "scope" is just a string that declares a specific permission
required.

It doesn't matter if it has other characters like ` : ` or if it is a URL.

Those details are implementation specific.

For OAuth2 they are just strings.

##  Code to get the ` username ` and ` password ` ¶

Now let's use the utilities provided by **FastAPI** to handle this.

###  ` OAuth2PasswordRequestForm ` ¶

First, import ` OAuth2PasswordRequestForm ` , and use it as a dependency with
` Depends ` in the _path operation_ for ` /token ` :

Python 3.10+  Python 3.9+  Python 3.8+  Python 3.10+ non-Annotated  Python
3.8+ non-Annotated

    
    
    from typing import Annotated
    
    from fastapi import Depends, FastAPI, HTTPException, status
    from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
    from pydantic import BaseModel
    
    fake_users_d