fastapi-cognito

What it is and what it does

fastapi-cognito is a FastAPI middleware library that integrates AWS Cognito JWT authentication into your application. It handles the mechanics of fetching Cognito's public keys, validating token signatures, checking expiration, and parsing token claims—letting you protect endpoints with a simple dependency injection pattern. The library supports multiple Cognito userpools, optional authentication, custom token models for extended claims, and both HTTP and WebSocket connections.

You configure it by providing your Cognito region, userpool ID, and app client ID (either in code, YAML, or JSON), then use it as a FastAPI dependency on any route. It does not handle user sign-up or sign-in; it assumes tokens are issued by Cognito and focuses entirely on validation and parsing. The package relies on fastapi, pydantic, pyyaml, aiofile, async-lru, joserfc, and httpx to manage async I/O, settings, and cryptographic verification.

Use it for

• Protect FastAPI endpoints with Cognito JWT tokens, extracting user identity and claims for authorization logic.
• Support optional authentication on public endpoints that may also serve authenticated users with different responses.
• Validate tokens from multiple Cognito userpools in a single application, routing by userpool name.
• Extend token validation with custom token models to parse application-specific claims beyond standard Cognito fields.
• Secure WebSocket connections by validating Cognito tokens during the handshake.
• Use custom JWKS URLs for local development with cognito-local or other Cognito-compatible identity providers.

Worth the install?

AI-flagged interpretation of the facts on this page. Verify before relying on it.

Install

fastapi-cognito on PyPI

Before you install

Low install friction with a pure-Python wheel. Maintenance status is aging—last commit was 495 days ago—but the repository remains active and the package supports current Python versions through 3.13.

Requires AWS Cognito service credentials (region, userpool ID, app client ID) and Python >=3.8.

License in practice

MIT license is permissive; you may use, modify, and distribute this package freely in commercial or private projects with minimal restrictions.

Quickstart

pip install fastapi-cognito

from fastapi import FastAPI, Depends
from fastapi_cognito import CognitoAuth, CognitoSettings, CognitoToken
from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    userpools: dict = {"default": {"region": "us-east-1", "userpool_id": "...", "app_client_id": "..."}}

settings = Settings()
cognito = CognitoAuth(settings=CognitoSettings.from_global_settings(settings))

app = FastAPI()

@app.get("/")
def protected(auth: CognitoToken = Depends(cognito.auth_required)):
    return {"message": "authenticated"}

Package facts

Evidence: fastapi_cognito-2.9.0-py3-none-any.whl

Tags

More Security packages

See also cognitojwt · Flask-Cognito · fastapi-cloudauth · axioms-fastapi · pycognito · warrant · fastapi-login · Flask-AWSCognito · spiffe · propelauth-fastapi