[ Resources  ](../../../resources/)

Resources

    * [ Full Stack FastAPI Template  ](../../../project-generation/)
    * [ External Links and Articles  ](../../../external-links/)
    * [ FastAPI and friends newsletter  ](../../../newsletter/)
  * [ About  ](../../../about/)

About

    * [ Alternatives, Inspiration and Comparisons  ](../../../alternatives/)
    * [ History, Design and Future  ](../../../history-design-future/)
    * [ Benchmarks  ](../../../benchmarks/)
  * [ Help  ](../../../help/)

Help

    * [ Help FastAPI - Get Help  ](../../../help-fastapi/)
    * [ Development - Contributing  ](../../../contributing/)
  * [ Release Notes  ](../../../release-notes/)

Table of contents

  * How it looks 
  * Create ` main.py `
  * Run it 
  * Check it 
  * The ` password ` flow 
  * **FastAPI** 's ` OAuth2PasswordBearer `
    * Use it 
  * What it does 
  * Recap 

  1. [ FastAPI  ](../../..)
  2. [ Learn  ](../../../learn/)
  3. [ Tutorial - User Guide  ](../../)
  4. [ Security  ](../)

#  Security - First Steps  ¶

Let's imagine that you have your **backend** API in some domain.

And you have a **frontend** in another domain or in a different path of the
same domain (or in a mobile application).

And you want to have a way for the frontend to authenticate with the backend,
using a **username** and **password** .

We can use **OAuth2** to build that with **FastAPI** .

But let's save you the time of reading the full long specification just to
find those little pieces of information you need.

Let's use the tools provided by **FastAPI** to handle security.

##  How it looks  ¶

Let's first just use the code and see how it works, and then we'll come back
to understand what's happening.

##  Create ` main.py ` ¶

Copy the example in a file ` main.py ` :

Python 3.9+  Python 3.8+  Python 3.8+ non-Annotated

    
    
    from typing import Annotated
    
    from fastapi import Depends, FastAPI
    from fastapi.security import OAuth2PasswordBearer
    
    app = FastAPI()
    
    oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
    
    
    @app.get("/items/")
    async def read_items(token: Annotated[str, Depends(oauth2_scheme)]):
        return {"token": token}
    
    
    
    from fastapi import Depends, FastAPI
    from fastapi.security import OAuth2PasswordBearer
    from typing_extensions import Annotated
    
    app = FastAPI()
    
    oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
    
    
    @app.get("/items/")
    async def read_items(token: Annotated[str, Depends(oauth2_scheme)]):
        return {"token": token}
    

Tip

Prefer to use the ` Annotated ` version if possible.

    
    
    from fastapi import Depends, FastAPI
    from fastapi.security import OAuth2PasswordBearer
    
    app = FastAPI()
    
    oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
    
    
    @app.get("/items/")
    async def read_items(token: str = Depends(oauth2_scheme)):
        return {"token": token}
    

##  Run it  ¶

Info

First install [ ` python-multipart ` ](https://github.com/Kludex/python-
multipart) .

E.g. ` pip install python-multipart ` .

This is because **OAuth2** uses "form data" for sending the ` username ` and `
password ` .

Run the example with:

    
    
    $ uvicorn main:app --reload
    
    <span style="color: green;">INFO</span>:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)
    

##  Check it  ¶

Go to the interactive docs at: [ http://127.0.0.1:8000/docs
](http://127.0.0.1:8000/docs) .

You will see something like this:

![](/img/tutorial/security/image01.png)

Authorize button!

You already have a shiny new "Authorize" button.

And your _path operation_ has a little lock in the top-right corner that you
can click.

And if you click it, you have a little authorization form to type a ` username
` and ` password ` (and other optional fields):

![](/img/tutorial/security/image02.png)

Note

It doesn't matter what you type in the form, it won't work