fastapi-users/fastapi-users
Fastapi Users
FastAPI Users is a ready-to-use authentication library for FastAPI applications that handles user registration, login, password reset, email verification, and profile retrieval with minimal configuration. It provides a complete authentication system built around pluggable backends and transports, supporting JWT tokens, database sessions, and Redis-based token storage that can be combined in a single route.
The library distinguishes itself through its modular architecture, offering router-based module composition that organizes authentication flows as independent FastAPI routers for registration, login, verification, and password reset. It supports multiple authentication methods simultaneously, including email-password login, OAuth2 social login through providers like Google and GitHub, and token-based email verification. The system provides dependency-injected authentication flows that chain multiple backends and transports, along with configurable password strength validation hooks that enforce security policies during registration or password changes.
For data persistence, FastAPI Users provides an abstract async storage interface with concrete implementations for SQLAlchemy (relational databases) and Beanie ODM (MongoDB), allowing developers to store user accounts and profiles in either SQL or document databases. The library generates complete OpenAPI documentation for all authentication endpoints, even when multiple backends are configured, and supports both header and cookie transport methods for accepting credentials.
Features
- User Authentication - Ready-to-use user registration, login, password reset, email verification, and profile retrieval for FastAPI applications.
- FastAPI Authentication Modules - Adding login, registration, password reset, and email verification to a FastAPI application with minimal code.
- Authenticated User Injection - Injects the authenticated user model into route handlers via FastAPI dependency injection.
- JWT Tokens - Issuing and validating JSON Web Tokens for stateless API authentication in a FastAPI backend.
- Async User Storage Abstractions - Provides an abstract async storage interface with SQLAlchemy and Beanie ODM implementations for user data.
- Pluggable Authentication Backends - Supports multiple authentication backends (JWT, database, Redis) and transports (header, cookie) in a single route.
- JWT Authentication - Issues and validates JSON Web Tokens for stateless user authentication in FastAPI routes.
- Multi-Method API Authentication - Supports several authentication methods (JWT, database session, Redis token) and transports (header, cookie) simultaneously.
- Password Authentication - Verifies a user's email and password against stored credentials and issues a session token.
- Session Token Issuance - Generates and validates authentication tokens stored in a JWT, database, or Redis backend.
- User Account Registrations - Creates a new user account with email and password, handling validation and storage.
- Email-Password Registrations - Creates a user account with email and password, storing credentials for future authentication.
- Credential Authentications - Verifies credentials on login and issues a token or session for subsequent requests.
- Authenticated User Injectors - Injects the authenticated user into route handlers through a FastAPI dependency callable.
- SQL or MongoDB User Storages - Persists user accounts and profiles in a relational database via SQLAlchemy or a document store via Beanie ODM.
- MongoDB User Storages - Stores user records in MongoDB documents using the Beanie ODM for FastAPI applications.
- Authentication Endpoint Documenters - Generates complete OpenAPI docs for all authentication endpoints, even with multiple backends.
- Header and Cookie Credential Acceptors - Accepts credentials from an Authorization header or a cookie, supporting multiple transport methods.
- Email Verification Flows - Confirms email ownership by sending a signed token link that the user must visit to activate their account.
- Password Complexity Validation - Validates password complexity at registration and change time using configurable callbacks.
- Password Strength Validators - Validating password strength against configurable rules during registration or password change.
- Social Login Providers - Authenticates a user through a third-party provider such as Google or GitHub using the OAuth2 flow.
- Social Login Integrations - Redirects a user to an external provider and creates or links an account on successful authorization.
- Password Resets - Sends a password reset link to the user's email and allows them to set a new password.
- OAuth Provider Adapters - Integrates third-party login providers through a common OAuth adapter interface.
- Authentication Flow Routers - Organizes authentication flows as independent FastAPI routers that can be mounted or customized separately.
- Authentication and Authorization - Full-featured account management and authentication system.
