How do you implement OAuth2 password flow with JWT in FastAPI?

Summary

Use OAuth2PasswordBearer(tokenUrl="token") as a dependency that extracts the Bearer token, issue signed JWTs (PyJWT) at the token endpoint after verifying the password hash, and decode/verify the token in a get_current_user dependency.

Longer Answer

Hash passwords with pwdlib/passlib (Argon2 or bcrypt). The token includes sub (user ID) and exp. get_current_user decodes with a pinned algorithm, loads the user, and raises 401 with a WWW-Authenticate: Bearer header on failure. Layer authorization with dependencies like require_role('admin') or OAuth2 scopes via Security().

Code Example

import jwt
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

@app.post("/token")
async def login(form: Annotated[OAuth2PasswordRequestForm, Depends()], db: DbSession):
    user = await authenticate(db, form.username, form.password)
    if not user:
        raise HTTPException(401, "Incorrect credentials", headers={"WWW-Authenticate": "Bearer"})
    token = jwt.encode({"sub": str(user.id), "exp": utcnow() + timedelta(minutes=30)}, SECRET, algorithm="HS256")
    return {"access_token": token, "token_type": "bearer"}

async def get_current_user(token: Annotated[str, Depends(oauth2_scheme)], db: DbSession) -> User:
    try:
        payload = jwt.decode(token, SECRET, algorithms=["HS256"])
    except jwt.InvalidTokenError:
        raise HTTPException(401, "Invalid token", headers={"WWW-Authenticate": "Bearer"})
    user = await db.get(User, int(payload["sub"]))
    if user is None:
        raise HTTPException(401, "User not found")
    return user

Key Points

• OAuth2PasswordBearer extracts the token
• Sign JWTs with expiry; pin algorithms
• get_current_user dependency
• Role/scope checks as composable dependencies