fastapi-cognito

What it is and what it does

fastapi-cognito is a FastAPI middleware library that integrates AWS Cognito JWT authentication into your application. It handles the mechanics of fetching Cognito's public keys, validating token signatures, checking expiration, and parsing token claims—letting you protect endpoints with a simple dependency injection pattern. The library supports multiple Cognito userpools, optional authentication, custom token models for extended claims, and both HTTP and WebSocket connections.

You configure it by providing your Cognito region, userpool ID, and app client ID (either in code, YAML, or JSON), then use it as a FastAPI dependency on any route. It does not handle user sign-up or sign-in; it assumes tokens are issued by Cognito and focuses entirely on validation and parsing. The package relies on fastapi, pydantic, pyyaml, aiofile, async-lru, joserfc, and httpx to manage async I/O, settings, and cryptographic verification.

Use it for:

• Protect FastAPI endpoints with Cognito JWT tokens, extracting user identity and claims for authorization logic.
• Support optional authentication on public endpoints that may also serve authenticated users with different responses.
• Validate tokens from multiple Cognito userpools in a single application, routing by userpool name.
• Extend token validation with custom token models to parse application-specific claims beyond standard Cognito fields.
• Secure WebSocket connections by validating Cognito tokens during the handshake.
• Use custom JWKS URLs for local development with cognito-local or other Cognito-compatible identity providers.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Decodes, validates, and parses AWS Cognito JWT tokens in FastAPI applications, supporting both HTTP and WebSocket authentication without handling sign-up or sign-in.

Yes, if you are building a FastAPI application backed by AWS Cognito and need straightforward JWT validation. The library is permissively licensed, has low install friction, and supports modern Python versions. However, maintenance is aging (last commit 495 days ago), so evaluate whether the package's feature set meets your needs and whether you are comfortable with slower response to issues. No known security vulnerabilities as of the query date.

Install

fastapi-cognito on PyPI

pip install fastapi-cognito

uv add fastapi-cognito

poetry add fastapi-cognito

Installing fastapi-cognito

Before you install

Low install friction with a pure-Python wheel. Maintenance status is aging—last commit was 495 days ago—but the repository remains active and the package supports current Python versions through 3.13.

License in practice

MIT license is permissive; you may use, modify, and distribute this package freely in commercial or private projects with minimal restrictions.

Quickstart

pip install fastapi-cognito

from fastapi import FastAPI, Depends
from fastapi_cognito import CognitoAuth, CognitoSettings, CognitoToken
from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    userpools: dict = {"default": {"region": "us-east-1", "userpool_id": "...", "app_client_id": "..."}}

settings = Settings()
cognito = CognitoAuth(settings=CognitoSettings.from_global_settings(settings))

app = FastAPI()

@app.get("/")
def protected(auth: CognitoToken = Depends(cognito.auth_required)):
    return {"message": "authenticated"}

Requires AWS Cognito service credentials (region, userpool ID, app client ID) and Python >=3.8.

Verify before relying

• Whether the package handles token refresh or only validates existing tokens.
• Performance characteristics when validating tokens from multiple userpools concurrently.
• Whether custom JWKS URLs work reliably with self-hosted or local Cognito implementations.

Package facts

Evidence: fastapi_cognito-2.9.0-py3-none-any.whl

Tags

More Security packages