fastapi-login

What it is and what it does

FastAPI-Login provides a Flask-Login-like authentication layer for FastAPI, handling JWT token creation, validation, and user session management. It wraps FastAPI's OAuth2 security model to let you protect routes with a simple dependency injection pattern, supporting both header-based bearer tokens and cookie-based sessions. The core workflow is: define a user loader callback, create tokens on login, then use the LoginManager as a route dependency to enforce authentication.

The package depends on fastapi, pyjwt, and typing-extensions. It supports Python 3.8 through 3.13 and runs on any OS. You provide the user lookup logic (database, in-memory store, etc.) and the package handles token lifecycle—encoding, decoding, expiration, and optional cookie management with HTTPOnly flags.

Use it for:

• Protect FastAPI routes with JWT bearer tokens, requiring users to authenticate before accessing sensitive endpoints.
• Implement cookie-based login flows for traditional web applications served by FastAPI, with automatic HTTPOnly flag handling.
• Build multi-user APIs where each request carries a user identity decoded from a signed token.
• Add custom exception handling for unauthenticated requests, e.g., redirecting to a login page.
• Manage token expiration policies per-request, e.g., short-lived access tokens with longer refresh windows.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Adds session and token-based user authentication to FastAPI applications using JWT, similar to Flask-Login's approach.

Yes, if you need straightforward JWT or cookie-based authentication in FastAPI without building token logic from scratch. The low install friction, permissive license, and stable API make it a practical choice. However, note the aging maintenance status—verify compatibility with your fastapi version and consider whether the package receives updates for security patches or breaking changes in its dependencies.

Install

fastapi-login on PyPI

pip install fastapi-login

uv add fastapi-login

poetry add fastapi-login

Installing fastapi-login

Before you install

Low install friction with a pure-Python wheel. Maintenance status is aging—last commit was 2025-05-20, with the latest release on 2024-12-14, though the repository remains active and not archived.

License in practice

MIT license is permissive; you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.

Quickstart

pip install fastapi-login

from fastapi import FastAPI, Depends
from fastapi_login import LoginManager

app = FastAPI()
manager = LoginManager('your-secret-key', token_url='/auth/token')

@manager.user_loader()
def load_user(email: str):
    return {'email': email}  # return user or None

@app.get('/protected')
def protected(user=Depends(manager)):
    return {'user': user}

Requires a secret key (generate via `import secrets; print(secrets.token_hex(24))`). For OAuth2PasswordRequestForm, the python-multipart package is required.

Verify before relying

• Whether the aging maintenance status affects compatibility with the latest fastapi versions.
• Performance characteristics under high-concurrency token validation loads.
• Whether cookie-based auth is suitable for your deployment model (SPA vs. traditional server-rendered).

Package facts

Evidence: fastapi_login-1.10.3-py3-none-any.whl

Tags

More Dynamic Content packages