From 41cdd898bfd517b7f7b7f4516fc8282023b006fc Mon Sep 17 00:00:00 2001 From: fastapi-users-ci Date: Fri, 4 Nov 2022 08:51:26 +0000 Subject: [PATCH] Deployed 1104460 to 10.2 with MkDocs 1.2.4 and mike 1.1.2 --- 10.2/index.html | 2 +- 10.2/search/search_index.json | 2 +- 10.2/sitemap.xml | 72 +++++++-------- 10.2/sitemap.xml.gz | Bin 217 -> 217 bytes 10.2/usage/routes/index.html | 168 +++++++++++++++++++--------------- 5 files changed, 130 insertions(+), 114 deletions(-) diff --git a/10.2/index.html b/10.2/index.html index d15c2377..e1990843 100644 --- a/10.2/index.html +++ b/10.2/index.html @@ -1373,7 +1373,7 @@ Smithybrewer
Smithybrewer
🐛 silllli
silllli
📖 alexferrari88
alexferrari88
💵 - sandalwoodbox
sandalwoodbox
🐛 + sandalwoodbox
sandalwoodbox
🐛 📖 Vlad Hoi
Vlad Hoi
📖 diff --git a/10.2/search/search_index.json b/10.2/search/search_index.json index 0fe737e4..933cb592 100644 --- a/10.2/search/search_index.json +++ b/10.2/search/search_index.json @@ -1 +1 @@ -{"config":{"indexing":"full","lang":["en"],"min_search_length":3,"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"FastAPI Users \u00b6 Ready-to-use and customizable users management for FastAPI Documentation : https://fastapi-users.github.io/fastapi-users/ Source Code : https://github.com/fastapi-users/fastapi-users Add quickly a registration and authentication system to your FastAPI project. FastAPI Users is designed to be as customizable and adaptable as possible. Features \u00b6 Extensible base user model Ready-to-use register, login, reset password and verify e-mail routes Ready-to-use social OAuth2 login flow Dependency callables to inject current user in route Pluggable password validation Customizable database backend SQLAlchemy ORM async included MongoDB with Beanie ODM included Multiple customizable authentication backends Transports: Authorization header, Cookie Strategies: JWT, Database, Redis Full OpenAPI schema support, even with several authentication backends In a hurry? Discover Fief, the open-source authentication platform \u00b6 Implementing registration, login, social auth is hard and painful. We know it. With our highly secure and open-source users management platform, you can focus on your app while staying in control of your users data. Based on FastAPI Users ! Open-source : self-host it for free or use our hosted version Bring your own database : host your database anywhere, we'll take care of the rest Pre-built login and registration pages : clean and fast authentication so you don't have to do it yourself Official Python client with built-in FastAPI integration It's free! Contributors and sponsors \u2728\u2615\ufe0f \u00b6 Thanks goes to these wonderful people ( emoji key ): Fran\u00e7ois Voron \ud83d\udea7 Paolo Dina \ud83d\udcb5 \ud83d\udcbb Dmytro Ohorodnik \ud83d\udc1b Matthew D. Scholefield \ud83d\udc1b roywes \ud83d\udc1b \ud83d\udcbb Satwik Kansal \ud83d\udcd6 Edd Salkield \ud83d\udcbb \ud83d\udcd6 mark-todd \ud83d\udcbb \ud83d\udcd6 lill74 \ud83d\udc1b \ud83d\udcbb \ud83d\udcd6 SelfhostedPro \ud83d\udee1\ufe0f \ud83d\udcbb Oskar Gmerek \ud83d\udcd6 Martin Collado \ud83d\udc1b \ud83d\udcbb Eric Lopes \ud83d\udcd6 \ud83d\udee1\ufe0f Beau Breon \ud83d\udcbb Niyas Mohammed \ud83d\udcd6 prostomarkeloff \ud83d\udcd6 \ud83d\udcbb Marius M\u00e9zerette \ud83d\udc1b \ud83e\udd14 Nickolas Grigoriadis \ud83d\udc1b Open Data Coder \ud83e\udd14 Mohammed Alshehri \ud83e\udd14 Tyler Renelle \ud83e\udd14 collerek \ud83d\udcbb Robert Bracco \ud83d\udcb5 Augusto Herrmann \ud83d\udcd6 Smithybrewer \ud83d\udc1b silllli \ud83d\udcd6 alexferrari88 \ud83d\udcb5 sandalwoodbox \ud83d\udc1b Vlad Hoi \ud83d\udcd6 Joe Nudell \ud83d\udc1b Ben \ud83d\udcbb BoYanZh \ud83d\udcd6 David Brochart \ud83d\udcd6 \ud83d\udcbb Daan Beverdam \ud83d\udcbb St\u00e9phane Raimbault \u26a0\ufe0f \ud83d\udc1b Sondre Lilleb\u00f8 Gundersen \ud83d\udcd6 Maxim \ud83d\udcd6 \ud83d\udc1b scottdavort \ud83d\udcb5 John Dukewich \ud83d\udcd6 Yasser Tahiri \ud83d\udcbb Brandon H. Goding \ud83d\udcbb PovilasK \ud83d\udcbb Just van den Broecke \ud83d\udcb5 jakemanger \ud83d\udc1b \ud83d\udcbb Ikko Ashimine \ud83d\udcbb Maty\u00e1\u0161 Richter \ud83d\udcbb Hazedd \ud83d\udc1b \ud83d\udcd6 Luis Roel \ud83d\udcb5 Alexandr Makurin \ud83d\udcbb \ud83d\udc1b Leon Thurner \ud83d\udcd6 Goran Meki\u0107 \ud83d\udce6 Gaganpreet \ud83d\udcbb Joe Taylor \ud83d\udcbb Richard Friberg \ud83d\udc1b Kenton Parton \ud83d\udcb5 Adrian Cio\u0142ek \ud83d\udc1b \u2b55Alexander Rymdeko-Harvey \ud83d\udcd6 schwannden \ud83d\udea7 \ud83d\udcbb Jimmy Angel P\u00e9rez D\u00edaz \ud83d\udee1\ufe0f Austin Orr \ud83d\udea7 Carlo Eugster \ud83d\udee1\ufe0f Vittorio Zamboni \ud83d\udcbb Andrey \ud83d\udcd6 Can H. Tartanoglu \ud83d\udc1b Filipe Nascimento \ud83d\udee1\ufe0f dudulu \ud83d\udcb5 Toni Alatalo \ud83d\udcbb \ud83d\udcd6 This project follows the all-contributors specification. Contributions of any kind welcome! Development \u00b6 Setup environment \u00b6 We use Hatch to manage the development environment and production build. Ensure it's installed on your system. Run unit tests \u00b6 You can run all the tests with: hatch run test Format the code \u00b6 Execute the following command to apply isort and black formatting: hatch run lint Serve the documentation \u00b6 You can serve the documentation locally with the following command: hatch run docs The documentation will be available on http://localhost:8000 . License \u00b6 This project is licensed under the terms of the MIT license.","title":"About"},{"location":"#fastapi-users","text":"Ready-to-use and customizable users management for FastAPI Documentation : https://fastapi-users.github.io/fastapi-users/ Source Code : https://github.com/fastapi-users/fastapi-users Add quickly a registration and authentication system to your FastAPI project. FastAPI Users is designed to be as customizable and adaptable as possible.","title":"FastAPI Users"},{"location":"#features","text":"Extensible base user model Ready-to-use register, login, reset password and verify e-mail routes Ready-to-use social OAuth2 login flow Dependency callables to inject current user in route Pluggable password validation Customizable database backend SQLAlchemy ORM async included MongoDB with Beanie ODM included Multiple customizable authentication backends Transports: Authorization header, Cookie Strategies: JWT, Database, Redis Full OpenAPI schema support, even with several authentication backends","title":"Features"},{"location":"#in-a-hurry-discover-fief-the-open-source-authentication-platform","text":"Implementing registration, login, social auth is hard and painful. We know it. With our highly secure and open-source users management platform, you can focus on your app while staying in control of your users data. Based on FastAPI Users ! Open-source : self-host it for free or use our hosted version Bring your own database : host your database anywhere, we'll take care of the rest Pre-built login and registration pages : clean and fast authentication so you don't have to do it yourself Official Python client with built-in FastAPI integration It's free!","title":"In a hurry? Discover Fief, the open-source authentication platform"},{"location":"#contributors-and-sponsors","text":"Thanks goes to these wonderful people ( emoji key ): Fran\u00e7ois Voron \ud83d\udea7 Paolo Dina \ud83d\udcb5 \ud83d\udcbb Dmytro Ohorodnik \ud83d\udc1b Matthew D. Scholefield \ud83d\udc1b roywes \ud83d\udc1b \ud83d\udcbb Satwik Kansal \ud83d\udcd6 Edd Salkield \ud83d\udcbb \ud83d\udcd6 mark-todd \ud83d\udcbb \ud83d\udcd6 lill74 \ud83d\udc1b \ud83d\udcbb \ud83d\udcd6 SelfhostedPro \ud83d\udee1\ufe0f \ud83d\udcbb Oskar Gmerek \ud83d\udcd6 Martin Collado \ud83d\udc1b \ud83d\udcbb Eric Lopes \ud83d\udcd6 \ud83d\udee1\ufe0f Beau Breon \ud83d\udcbb Niyas Mohammed \ud83d\udcd6 prostomarkeloff \ud83d\udcd6 \ud83d\udcbb Marius M\u00e9zerette \ud83d\udc1b \ud83e\udd14 Nickolas Grigoriadis \ud83d\udc1b Open Data Coder \ud83e\udd14 Mohammed Alshehri \ud83e\udd14 Tyler Renelle \ud83e\udd14 collerek \ud83d\udcbb Robert Bracco \ud83d\udcb5 Augusto Herrmann \ud83d\udcd6 Smithybrewer \ud83d\udc1b silllli \ud83d\udcd6 alexferrari88 \ud83d\udcb5 sandalwoodbox \ud83d\udc1b Vlad Hoi \ud83d\udcd6 Joe Nudell \ud83d\udc1b Ben \ud83d\udcbb BoYanZh \ud83d\udcd6 David Brochart \ud83d\udcd6 \ud83d\udcbb Daan Beverdam \ud83d\udcbb St\u00e9phane Raimbault \u26a0\ufe0f \ud83d\udc1b Sondre Lilleb\u00f8 Gundersen \ud83d\udcd6 Maxim \ud83d\udcd6 \ud83d\udc1b scottdavort \ud83d\udcb5 John Dukewich \ud83d\udcd6 Yasser Tahiri \ud83d\udcbb Brandon H. Goding \ud83d\udcbb PovilasK \ud83d\udcbb Just van den Broecke \ud83d\udcb5 jakemanger \ud83d\udc1b \ud83d\udcbb Ikko Ashimine \ud83d\udcbb Maty\u00e1\u0161 Richter \ud83d\udcbb Hazedd \ud83d\udc1b \ud83d\udcd6 Luis Roel \ud83d\udcb5 Alexandr Makurin \ud83d\udcbb \ud83d\udc1b Leon Thurner \ud83d\udcd6 Goran Meki\u0107 \ud83d\udce6 Gaganpreet \ud83d\udcbb Joe Taylor \ud83d\udcbb Richard Friberg \ud83d\udc1b Kenton Parton \ud83d\udcb5 Adrian Cio\u0142ek \ud83d\udc1b \u2b55Alexander Rymdeko-Harvey \ud83d\udcd6 schwannden \ud83d\udea7 \ud83d\udcbb Jimmy Angel P\u00e9rez D\u00edaz \ud83d\udee1\ufe0f Austin Orr \ud83d\udea7 Carlo Eugster \ud83d\udee1\ufe0f Vittorio Zamboni \ud83d\udcbb Andrey \ud83d\udcd6 Can H. Tartanoglu \ud83d\udc1b Filipe Nascimento \ud83d\udee1\ufe0f dudulu \ud83d\udcb5 Toni Alatalo \ud83d\udcbb \ud83d\udcd6 This project follows the all-contributors specification. Contributions of any kind welcome!","title":"Contributors and sponsors \u2728\u2615\ufe0f"},{"location":"#development","text":"","title":"Development"},{"location":"#setup-environment","text":"We use Hatch to manage the development environment and production build. Ensure it's installed on your system.","title":"Setup environment"},{"location":"#run-unit-tests","text":"You can run all the tests with: hatch run test","title":"Run unit tests"},{"location":"#format-the-code","text":"Execute the following command to apply isort and black formatting: hatch run lint","title":"Format the code"},{"location":"#serve-the-documentation","text":"You can serve the documentation locally with the following command: hatch run docs The documentation will be available on http://localhost:8000 .","title":"Serve the documentation"},{"location":"#license","text":"This project is licensed under the terms of the MIT license.","title":"License"},{"location":"installation/","text":"Installation \u00b6 You can add FastAPI Users to your FastAPI project in a few easy steps. First of all, install the dependency: With SQLAlchemy support \u00b6 pip install 'fastapi-users[sqlalchemy]' With Beanie support \u00b6 pip install 'fastapi-users[beanie]' With Redis authentication backend support \u00b6 Information on installing with proper database support can be found in the Redis section. With OAuth2 support \u00b6 Information on installing with proper database support can be found in the OAuth2 section. That's it! In the next section, we'll have an overview of how things work.","title":"Installation"},{"location":"installation/#installation","text":"You can add FastAPI Users to your FastAPI project in a few easy steps. First of all, install the dependency:","title":"Installation"},{"location":"installation/#with-sqlalchemy-support","text":"pip install 'fastapi-users[sqlalchemy]'","title":"With SQLAlchemy support"},{"location":"installation/#with-beanie-support","text":"pip install 'fastapi-users[beanie]'","title":"With Beanie support"},{"location":"installation/#with-redis-authentication-backend-support","text":"Information on installing with proper database support can be found in the Redis section.","title":"With Redis authentication backend support"},{"location":"installation/#with-oauth2-support","text":"Information on installing with proper database support can be found in the OAuth2 section. That's it! In the next section, we'll have an overview of how things work.","title":"With OAuth2 support"},{"location":"configuration/full-example/","text":"Full example \u00b6 Here is a full working example with JWT authentication to help get you started. Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database. SQLAlchemy \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True ) Beanie \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True ) What now? \u00b6 You're ready to go! Be sure to check the Usage section to understand how to work with FastAPI Users .","title":"Full example"},{"location":"configuration/full-example/#full-example","text":"Here is a full working example with JWT authentication to help get you started. Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database.","title":"Full example"},{"location":"configuration/full-example/#sqlalchemy","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"SQLAlchemy"},{"location":"configuration/full-example/#beanie","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"Beanie"},{"location":"configuration/full-example/#what-now","text":"You're ready to go! Be sure to check the Usage section to understand how to work with FastAPI Users .","title":"What now?"},{"location":"configuration/oauth/","text":"OAuth2 \u00b6 FastAPI Users provides an optional OAuth2 authentication support. It relies on HTTPX OAuth library , which is a pure-async implementation of OAuth2. Installation \u00b6 You should install the library with the optional dependencies for OAuth: pip install 'fastapi-users[sqlalchemy,oauth]' pip install 'fastapi-users[beanie,oauth]' Configuration \u00b6 Instantiate an OAuth2 client \u00b6 You first need to get an HTTPX OAuth client instance. Read the documentation for more information. from httpx_oauth.clients.google import GoogleOAuth2 google_oauth_client = GoogleOAuth2 ( \"CLIENT_ID\" , \"CLIENT_SECRET\" ) Setup the database adapter \u00b6 SQLAlchemy \u00b6 You'll need to define the SQLAlchemy model for storing OAuth accounts. We provide a base one for this: from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) Notice that we also manually added a relationship on the UserTable so that SQLAlchemy can properly retrieve the OAuth accounts of the user. Besides, when instantiating the database adapter, we need pass this SQLAlchemy model as third argument. Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseOAuthAccountTable as base class and define your own id and user_id column. class OAuthAccount ( SQLAlchemyBaseOAuthAccountTable [ int ], Base ): id = Column ( Integer , primary_key = True ) @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseOAuthAccountTable expects a generic type to define the actual type of ID you use. Beanie \u00b6 The advantage of MongoDB is that you can easily embed sub-objects in a single document. That's why the configuration for Beanie is quite simple. All we need to do is to define another class to structure an OAuth account object. from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) It's worth to note that OAuthAccount is not a Beanie document but a Pydantic model that we'll embed inside the User document, through the oauth_accounts array. Generate routers \u00b6 Once you have a FastAPIUsers instance, you can make it generate a single OAuth router for a given client and authentication backend. app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Tip If you have several OAuth clients and/or several authentication backends, you'll need to create a router for each pair you want to support. Existing account association \u00b6 If a user with the same e-mail address already exists, an HTTP 400 error will be raised by default. You can however choose to automatically link this OAuth account to the existing user account by setting the associate_by_email flag: app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" , associate_by_email = True , ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Bear in mind though that it can lead to security breaches if the OAuth provider does not validate e-mail addresses. How? Let's say your app support an OAuth provider, Merlinbook , which does not validate e-mail addresses. Imagine a user registers to your app with the e-mail address lancelot@camelot.bt . Now, a malicious user creates an account on Merlinbook with the same e-mail address. Without e-mail validation, the malicious user can use this account without limitation. The malicious user authenticates using Merlinbook OAuth on your app, which automatically associates to the existing lancelot@camelot.bt . Now, the malicious user has full access to the user account on your app \ud83d\ude1e Association router for authenticated users \u00b6 We also provide a router to associate an already authenticated user with an OAuth account. After this association, the user will be able to authenticate with this OAuth provider. app . include_router ( fastapi_users . get_oauth_associate_router ( google_oauth_client , UserRead , \"SECRET\" ), prefix = \"/auth/associate/google\" , tags = [ \"auth\" ], ) Notice that, just like for the Users router , you have to pass the UserRead Pydantic schema. Full example \u00b6 Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database. SQLAlchemy \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True ) Beanie \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"OAuth2"},{"location":"configuration/oauth/#oauth2","text":"FastAPI Users provides an optional OAuth2 authentication support. It relies on HTTPX OAuth library , which is a pure-async implementation of OAuth2.","title":"OAuth2"},{"location":"configuration/oauth/#installation","text":"You should install the library with the optional dependencies for OAuth: pip install 'fastapi-users[sqlalchemy,oauth]' pip install 'fastapi-users[beanie,oauth]'","title":"Installation"},{"location":"configuration/oauth/#configuration","text":"","title":"Configuration"},{"location":"configuration/oauth/#instantiate-an-oauth2-client","text":"You first need to get an HTTPX OAuth client instance. Read the documentation for more information. from httpx_oauth.clients.google import GoogleOAuth2 google_oauth_client = GoogleOAuth2 ( \"CLIENT_ID\" , \"CLIENT_SECRET\" )","title":"Instantiate an OAuth2 client"},{"location":"configuration/oauth/#setup-the-database-adapter","text":"","title":"Setup the database adapter"},{"location":"configuration/oauth/#sqlalchemy","text":"You'll need to define the SQLAlchemy model for storing OAuth accounts. We provide a base one for this: from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) Notice that we also manually added a relationship on the UserTable so that SQLAlchemy can properly retrieve the OAuth accounts of the user. Besides, when instantiating the database adapter, we need pass this SQLAlchemy model as third argument. Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseOAuthAccountTable as base class and define your own id and user_id column. class OAuthAccount ( SQLAlchemyBaseOAuthAccountTable [ int ], Base ): id = Column ( Integer , primary_key = True ) @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseOAuthAccountTable expects a generic type to define the actual type of ID you use.","title":"SQLAlchemy"},{"location":"configuration/oauth/#beanie","text":"The advantage of MongoDB is that you can easily embed sub-objects in a single document. That's why the configuration for Beanie is quite simple. All we need to do is to define another class to structure an OAuth account object. from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) It's worth to note that OAuthAccount is not a Beanie document but a Pydantic model that we'll embed inside the User document, through the oauth_accounts array.","title":"Beanie"},{"location":"configuration/oauth/#generate-routers","text":"Once you have a FastAPIUsers instance, you can make it generate a single OAuth router for a given client and authentication backend. app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Tip If you have several OAuth clients and/or several authentication backends, you'll need to create a router for each pair you want to support.","title":"Generate routers"},{"location":"configuration/oauth/#existing-account-association","text":"If a user with the same e-mail address already exists, an HTTP 400 error will be raised by default. You can however choose to automatically link this OAuth account to the existing user account by setting the associate_by_email flag: app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" , associate_by_email = True , ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Bear in mind though that it can lead to security breaches if the OAuth provider does not validate e-mail addresses. How? Let's say your app support an OAuth provider, Merlinbook , which does not validate e-mail addresses. Imagine a user registers to your app with the e-mail address lancelot@camelot.bt . Now, a malicious user creates an account on Merlinbook with the same e-mail address. Without e-mail validation, the malicious user can use this account without limitation. The malicious user authenticates using Merlinbook OAuth on your app, which automatically associates to the existing lancelot@camelot.bt . Now, the malicious user has full access to the user account on your app \ud83d\ude1e","title":"Existing account association"},{"location":"configuration/oauth/#association-router-for-authenticated-users","text":"We also provide a router to associate an already authenticated user with an OAuth account. After this association, the user will be able to authenticate with this OAuth provider. app . include_router ( fastapi_users . get_oauth_associate_router ( google_oauth_client , UserRead , \"SECRET\" ), prefix = \"/auth/associate/google\" , tags = [ \"auth\" ], ) Notice that, just like for the Users router , you have to pass the UserRead Pydantic schema.","title":"Association router for authenticated users"},{"location":"configuration/oauth/#full-example","text":"Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database.","title":"Full example"},{"location":"configuration/oauth/#sqlalchemy_1","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"SQLAlchemy"},{"location":"configuration/oauth/#beanie_1","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"Beanie"},{"location":"configuration/overview/","text":"Overview \u00b6 The schema below shows you how the library is structured and how each part fit together. flowchart TB FASTAPI_USERS{FastAPIUsers} USER_MANAGER{UserManager} USER_MODEL{User model} DATABASE_DEPENDENCY[[get_user_db]] USER_MANAGER_DEPENDENCY[[get_user_manager]] CURRENT_USER[[current_user]] subgraph SCHEMAS[Schemas] USER[User] USER_CREATE[UserCreate] USER_UPDATE[UserUpdate] end subgraph DATABASE[Database adapters] SQLALCHEMY[SQLAlchemy] BEANIE[Beanie] end subgraph ROUTERS[Routers] AUTH[[get_auth_router]] OAUTH[[get_oauth_router]] OAUTH_ASSOCIATE[[get_oauth_associate_router]] REGISTER[[get_register_router]] VERIFY[[get_verify_router]] RESET[[get_reset_password_router]] USERS[[get_users_router]] end subgraph AUTH_BACKENDS[Authentication] subgraph TRANSPORTS[Transports] COOKIE[CookieTransport] BEARER[BearerTransport] end subgraph STRATEGIES[Strategies] DB[DatabaseStrategy] JWT[JWTStrategy] REDIS[RedisStrategy] end AUTH_BACKEND{AuthenticationBackend} end DATABASE --> DATABASE_DEPENDENCY USER_MODEL --> DATABASE_DEPENDENCY DATABASE_DEPENDENCY --> USER_MANAGER USER_MANAGER --> USER_MANAGER_DEPENDENCY USER_MANAGER_DEPENDENCY --> FASTAPI_USERS FASTAPI_USERS --> ROUTERS TRANSPORTS --> AUTH_BACKEND STRATEGIES --> AUTH_BACKEND AUTH_BACKEND --> ROUTERS AUTH_BACKEND --> FASTAPI_USERS FASTAPI_USERS --> CURRENT_USER SCHEMAS --> ROUTERS User model and database adapters \u00b6 FastAPI Users is compatible with various databases and ORM . To build the interface between those database tools and the library, we provide database adapters classes that you need to instantiate and configure. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using Beanie Authentication backends \u00b6 Authentication backends define the way users sessions are managed in your app, like access tokens or cookies. They are composed of two parts: a transport , which is how the token will be carried over the requests (e.g. cookies, headers...) and a strategy , which is how the token will be generated and secured (e.g. a JWT, a token in database...). \u27a1\ufe0f Configure the authentication backends UserManager \u00b6 The UserManager object bears most of the logic of FastAPI Users: registration, verification, password reset... We provide a BaseUserManager with this common logic; which you should overload to define how to validate passwords or handle events. This UserManager object should be provided through a FastAPI dependency, get_user_manager . \u27a1\ufe0f Configure UserManager Schemas \u00b6 FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. \u27a1\ufe0f Configure schemas FastAPIUsers and routers \u00b6 Finally, FastAPIUsers object is the main class from which you'll be able to generate routers for classic routes like registration or login, but also get the current_user dependency factory to inject the authenticated user in your own routes. \u27a1\ufe0f Configure FastAPIUsers and routers","title":"Overview"},{"location":"configuration/overview/#overview","text":"The schema below shows you how the library is structured and how each part fit together. flowchart TB FASTAPI_USERS{FastAPIUsers} USER_MANAGER{UserManager} USER_MODEL{User model} DATABASE_DEPENDENCY[[get_user_db]] USER_MANAGER_DEPENDENCY[[get_user_manager]] CURRENT_USER[[current_user]] subgraph SCHEMAS[Schemas] USER[User] USER_CREATE[UserCreate] USER_UPDATE[UserUpdate] end subgraph DATABASE[Database adapters] SQLALCHEMY[SQLAlchemy] BEANIE[Beanie] end subgraph ROUTERS[Routers] AUTH[[get_auth_router]] OAUTH[[get_oauth_router]] OAUTH_ASSOCIATE[[get_oauth_associate_router]] REGISTER[[get_register_router]] VERIFY[[get_verify_router]] RESET[[get_reset_password_router]] USERS[[get_users_router]] end subgraph AUTH_BACKENDS[Authentication] subgraph TRANSPORTS[Transports] COOKIE[CookieTransport] BEARER[BearerTransport] end subgraph STRATEGIES[Strategies] DB[DatabaseStrategy] JWT[JWTStrategy] REDIS[RedisStrategy] end AUTH_BACKEND{AuthenticationBackend} end DATABASE --> DATABASE_DEPENDENCY USER_MODEL --> DATABASE_DEPENDENCY DATABASE_DEPENDENCY --> USER_MANAGER USER_MANAGER --> USER_MANAGER_DEPENDENCY USER_MANAGER_DEPENDENCY --> FASTAPI_USERS FASTAPI_USERS --> ROUTERS TRANSPORTS --> AUTH_BACKEND STRATEGIES --> AUTH_BACKEND AUTH_BACKEND --> ROUTERS AUTH_BACKEND --> FASTAPI_USERS FASTAPI_USERS --> CURRENT_USER SCHEMAS --> ROUTERS","title":"Overview"},{"location":"configuration/overview/#user-model-and-database-adapters","text":"FastAPI Users is compatible with various databases and ORM . To build the interface between those database tools and the library, we provide database adapters classes that you need to instantiate and configure. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using Beanie","title":"User model and database adapters"},{"location":"configuration/overview/#authentication-backends","text":"Authentication backends define the way users sessions are managed in your app, like access tokens or cookies. They are composed of two parts: a transport , which is how the token will be carried over the requests (e.g. cookies, headers...) and a strategy , which is how the token will be generated and secured (e.g. a JWT, a token in database...). \u27a1\ufe0f Configure the authentication backends","title":"Authentication backends"},{"location":"configuration/overview/#usermanager","text":"The UserManager object bears most of the logic of FastAPI Users: registration, verification, password reset... We provide a BaseUserManager with this common logic; which you should overload to define how to validate passwords or handle events. This UserManager object should be provided through a FastAPI dependency, get_user_manager . \u27a1\ufe0f Configure UserManager","title":"UserManager"},{"location":"configuration/overview/#schemas","text":"FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. \u27a1\ufe0f Configure schemas","title":"Schemas"},{"location":"configuration/overview/#fastapiusers-and-routers","text":"Finally, FastAPIUsers object is the main class from which you'll be able to generate routers for classic routes like registration or login, but also get the current_user dependency factory to inject the authenticated user in your own routes. \u27a1\ufe0f Configure FastAPIUsers and routers","title":"FastAPIUsers and routers"},{"location":"configuration/password-hash/","text":"Password hash \u00b6 By default, FastAPI Users will use the BCrypt algorithm to hash and salt passwords before storing them in the database. The implementation is provided by Passlib , a battle-tested Python library for password hashing. Customize CryptContext \u00b6 If you need to support other hashing algorithms, you can customize the CryptContext object of Passlib . For this, you'll need to instantiate the PasswordHelper class and pass it your CryptContext . The example below shows you how you can create a CryptContext to add support for the Argon2 algorithm while deprecating BCrypt. from fastapi_users.password import PasswordHelper from passlib.context import CryptContext context = CryptContext ( schemes = [ \"argon2\" , \"bcrypt\" ], deprecated = \"auto\" ) password_helper = PasswordHelper ( context ) Finally, pass the password_helper variable while instantiating your UserManager : async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db , password_helper ) Password hashes are automatically upgraded FastAPI Users takes care of upgrading the password hash to a more recent algorithm when needed. Typically, when a user logs in, we'll check if the password hash algorithm is deprecated. If it is, we take the opportunity of having the password in plain-text at hand (since the user just logged in!) to hash it with a better algorithm and update it in database. Dependencies for alternative algorithms are not included by default FastAPI Users won't install required dependencies to make other algorithms like Argon2 work. It's up to you to install them. Full customization \u00b6 If you don't wist to use Passlib at all \u2013 which we don't recommend unless you're absolutely sure of what you're doing \u2014 you can implement your own PasswordHelper class as long as it implements the PasswordHelperProtocol and its methods. from typing import Tuple from fastapi_users.password import PasswordHelperProtocol class PasswordHelper ( PasswordHelperProtocol ): def verify_and_update ( self , plain_password : str , hashed_password : str ) -> Tuple [ bool , str ]: ... def hash ( self , password : str ) -> str : ... def generate ( self ) -> str : ...","title":"Password hash"},{"location":"configuration/password-hash/#password-hash","text":"By default, FastAPI Users will use the BCrypt algorithm to hash and salt passwords before storing them in the database. The implementation is provided by Passlib , a battle-tested Python library for password hashing.","title":"Password hash"},{"location":"configuration/password-hash/#customize-cryptcontext","text":"If you need to support other hashing algorithms, you can customize the CryptContext object of Passlib . For this, you'll need to instantiate the PasswordHelper class and pass it your CryptContext . The example below shows you how you can create a CryptContext to add support for the Argon2 algorithm while deprecating BCrypt. from fastapi_users.password import PasswordHelper from passlib.context import CryptContext context = CryptContext ( schemes = [ \"argon2\" , \"bcrypt\" ], deprecated = \"auto\" ) password_helper = PasswordHelper ( context ) Finally, pass the password_helper variable while instantiating your UserManager : async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db , password_helper ) Password hashes are automatically upgraded FastAPI Users takes care of upgrading the password hash to a more recent algorithm when needed. Typically, when a user logs in, we'll check if the password hash algorithm is deprecated. If it is, we take the opportunity of having the password in plain-text at hand (since the user just logged in!) to hash it with a better algorithm and update it in database. Dependencies for alternative algorithms are not included by default FastAPI Users won't install required dependencies to make other algorithms like Argon2 work. It's up to you to install them.","title":"Customize CryptContext"},{"location":"configuration/password-hash/#full-customization","text":"If you don't wist to use Passlib at all \u2013 which we don't recommend unless you're absolutely sure of what you're doing \u2014 you can implement your own PasswordHelper class as long as it implements the PasswordHelperProtocol and its methods. from typing import Tuple from fastapi_users.password import PasswordHelperProtocol class PasswordHelper ( PasswordHelperProtocol ): def verify_and_update ( self , plain_password : str , hashed_password : str ) -> Tuple [ bool , str ]: ... def hash ( self , password : str ) -> str : ... def generate ( self ) -> str : ...","title":"Full customization"},{"location":"configuration/schemas/","text":"Schemas \u00b6 FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. It's different from your User model , which is an object that actually interacts with the database. Those schemas on the other hand are here to validate data and serialize correct it in the API. FastAPI Users provides a base structure to cover its needs. It is structured like this: id ( ID ) \u2013 Unique identifier of the user. It matches the type of your ID, like UUID or integer. email ( str ) \u2013 Email of the user. Validated by email-validator . is_active ( bool ) \u2013 Whether or not the user is active. If not, login and forgot password requests will be denied. Defaults to True . is_verified ( bool ) \u2013 Whether or not the user is verified. Optional but helpful with the verify router logic. Defaults to False . is_superuser ( bool ) \u2013 Whether or not the user is a superuser. Useful to implement administration logic. Defaults to False . Define your schemas \u00b6 There are four Pydantic models variations provided as mixins: BaseUser , which provides the basic fields and validation; BaseCreateUser , dedicated to user registration, which consists of compulsory email and password fields; BaseUpdateUser , dedicated to user profile update, which adds an optional password field; You should define each of those variations, inheriting from each mixin: import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass Typing: ID generic type is expected You can see that we define a generic type when extending the BaseUser class. It should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. Adding your own fields \u00b6 You can of course add your own properties there to fit to your needs. In the example below, we add a required string property, first_name , and an optional date property, birthdate . import datetime import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): first_name : str birthdate : Optional [ datetime . date ] class UserCreate ( schemas . BaseUserCreate ): first_name : str birthdate : Optional [ datetime . date ] class UserUpdate ( schemas . BaseUserUpdate ): first_name : Optional [ str ] birthdate : Optional [ datetime . date ] Make sure to mirror this in your database model The User model you defined earlier for your specific database will be the central object that will actually store the data. Therefore, you need to define the very same fields in it so the data can be actually stored.","title":"Schemas"},{"location":"configuration/schemas/#schemas","text":"FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. It's different from your User model , which is an object that actually interacts with the database. Those schemas on the other hand are here to validate data and serialize correct it in the API. FastAPI Users provides a base structure to cover its needs. It is structured like this: id ( ID ) \u2013 Unique identifier of the user. It matches the type of your ID, like UUID or integer. email ( str ) \u2013 Email of the user. Validated by email-validator . is_active ( bool ) \u2013 Whether or not the user is active. If not, login and forgot password requests will be denied. Defaults to True . is_verified ( bool ) \u2013 Whether or not the user is verified. Optional but helpful with the verify router logic. Defaults to False . is_superuser ( bool ) \u2013 Whether or not the user is a superuser. Useful to implement administration logic. Defaults to False .","title":"Schemas"},{"location":"configuration/schemas/#define-your-schemas","text":"There are four Pydantic models variations provided as mixins: BaseUser , which provides the basic fields and validation; BaseCreateUser , dedicated to user registration, which consists of compulsory email and password fields; BaseUpdateUser , dedicated to user profile update, which adds an optional password field; You should define each of those variations, inheriting from each mixin: import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass Typing: ID generic type is expected You can see that we define a generic type when extending the BaseUser class. It should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID.","title":"Define your schemas"},{"location":"configuration/schemas/#adding-your-own-fields","text":"You can of course add your own properties there to fit to your needs. In the example below, we add a required string property, first_name , and an optional date property, birthdate . import datetime import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): first_name : str birthdate : Optional [ datetime . date ] class UserCreate ( schemas . BaseUserCreate ): first_name : str birthdate : Optional [ datetime . date ] class UserUpdate ( schemas . BaseUserUpdate ): first_name : Optional [ str ] birthdate : Optional [ datetime . date ] Make sure to mirror this in your database model The User model you defined earlier for your specific database will be the central object that will actually store the data. Therefore, you need to define the very same fields in it so the data can be actually stored.","title":"Adding your own fields"},{"location":"configuration/user-manager/","text":"UserManager \u00b6 The UserManager class is the core logic of FastAPI Users. We provide the BaseUserManager class which you should extend to set some parameters and define logic, for example when a user just registered or forgot its password. It's designed to be easily extensible and customizable so that you can integrate your very own logic. Create your UserManager class \u00b6 You should define your own version of the UserManager class to set various parameters. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) As you can see, you have to define here various attributes and methods. You can find the complete list of those below. Typing: User and ID generic types are expected You can see that we define two generic types when extending the base class: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion when implementing the custom methods. The ID parser mixin \u00b6 Since the user ID is fully generic, we need a way to parse it reliably when it'll come from API requests , typically as URL path attributes. That's why we added the UUIDIDMixin in the example above. It implements the parse_id method, ensuring UUID are valid and correctly parsed. Of course, it's important that this logic matches the type of your ID . To help you with this, we provide mixins for the most common cases: UUIDIDMixin , for UUID ID. IntegerIDMixin , for integer ID. ObjectIDIDMixin (provided by fastapi_users_db_beanie ), for MongoDB ObjectID. Inheritance order matters Notice in your example that the mixin comes first in our UserManager inheritance . Because of the Method-Resolution-Order (MRO) of Python, the left-most element takes precedence. If you need another type of ID, you can simply overload the parse_id method on your UserManager class: from fastapi_users import BaseUserManager , InvalidID class UserManager ( BaseUserManager [ User , MyCustomID ]): def parse_id ( self , value : Any ) -> MyCustomID : try : return MyCustomID ( value ) except ValueError as e : raise InvalidID () from e # (1)! If the ID can't be parsed into the desired type, you'll need to raise an InvalidID exception. Create get_user_manager dependency \u00b6 The UserManager class will be injected at runtime using a FastAPI dependency. This way, you can run it in a database session or swap it with a mock during testing. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) Notice that we use the get_user_db dependency we defined earlier to inject the database instance. Customize attributes and methods \u00b6 Attributes \u00b6 reset_password_token_secret : Secret to encode reset password token. Use a strong passphrase and keep it secure. reset_password_token_lifetime_seconds : Lifetime of reset password token. Defaults to 3600. reset_password_token_audience : JWT audience of reset password token. Defaults to fastapi-users:reset . verification_token_secret : Secret to encode verification token. Use a strong passphrase and keep it secure. verification_token_lifetime_seconds : Lifetime of verification token. Defaults to 3600. verification_token_audience : JWT audience of verification token. Defaults to fastapi-users:verify . Methods \u00b6 validate_password \u00b6 Validate a password. Arguments password ( str ): the password to validate. user ( Union[UserCreate, User] ): user model which we are currently validating the password. Useful if you want to check that the password doesn't contain the name or the birthdate of the user for example. Output This function should return None if the password is valid or raise InvalidPasswordException if not. This exception expects an argument reason telling why the password is invalid. It'll be part of the error response. Example from fastapi_users import BaseUserManager , InvalidPasswordException , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def validate_password ( self , password : str , user : Union [ UserCreate , User ], ) -> None : if len ( password ) < 8 : raise InvalidPasswordException ( reason = \"Password should be at least 8 characters\" ) if user . email in password : raise InvalidPasswordException ( reason = \"Password should not contain e-mail\" ) on_after_register \u00b6 Perform logic after successful user registration. Typically, you'll want to send a welcome e-mail or add it to your marketing analytics pipeline. Arguments user ( User ): the registered user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) on_after_update \u00b6 Perform logic after successful user update. It may be useful, for example, if you wish to update your user in a data analytics or customer success platform. Arguments user ( User ): the updated user. update_dict ( Dict[str, Any] ): dictionary with the updated user fields. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_update ( self , user : User , update_dict : Dict [ str , Any ], request : Optional [ Request ] = None , ): print ( f \"User { user . id } has been updated with { update_dict } .\" ) on_after_login \u00b6 Perform logic after a successful user login. It may be useful for custom logic or processes triggered by new logins, for example a daily login reward or for analytics. Arguments user ( User ): the updated user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_login ( self , user : User , request : Optional [ Request ] = None , ): print ( f \"User { user . id } logged in.\" ) on_after_request_verify \u00b6 Perform logic after successful verification request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to verify their e-mail. Arguments user ( User ): the user to verify. token ( str ): the verification token. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) on_after_verify \u00b6 Perform logic after successful user verification. This may be useful if you wish to send another e-mail or store this information in a data analytics or customer success platform. Arguments user ( User ): the verified user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_verify ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has been verified\" ) on_after_forgot_password \u00b6 Perform logic after successful forgot password request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to reset their password. Arguments user ( User ): the user that forgot its password. token ( str ): the forgot password token request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) on_after_reset_password \u00b6 Perform logic after successful password reset. For example, you may want to send an e-mail to the concerned user to warn him that their password has been changed and that they should take action if they think they have been hacked. Arguments user ( User ): the user that reset its password. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_reset_password ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has reset their password.\" ) on_before_delete \u00b6 Perform logic before user delete. For example, you may want to valide user resource integrity to see if any related user resource need to be marked inactive, or delete them recursively. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_before_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is going to be deleted\" ) on_after_delete \u00b6 Perform logic after user delete. For example, you may want to send an email to the administrator about the event. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is successfully deleted\" )","title":"UserManager"},{"location":"configuration/user-manager/#usermanager","text":"The UserManager class is the core logic of FastAPI Users. We provide the BaseUserManager class which you should extend to set some parameters and define logic, for example when a user just registered or forgot its password. It's designed to be easily extensible and customizable so that you can integrate your very own logic.","title":"UserManager"},{"location":"configuration/user-manager/#create-your-usermanager-class","text":"You should define your own version of the UserManager class to set various parameters. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) As you can see, you have to define here various attributes and methods. You can find the complete list of those below. Typing: User and ID generic types are expected You can see that we define two generic types when extending the base class: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion when implementing the custom methods.","title":"Create your UserManager class"},{"location":"configuration/user-manager/#the-id-parser-mixin","text":"Since the user ID is fully generic, we need a way to parse it reliably when it'll come from API requests , typically as URL path attributes. That's why we added the UUIDIDMixin in the example above. It implements the parse_id method, ensuring UUID are valid and correctly parsed. Of course, it's important that this logic matches the type of your ID . To help you with this, we provide mixins for the most common cases: UUIDIDMixin , for UUID ID. IntegerIDMixin , for integer ID. ObjectIDIDMixin (provided by fastapi_users_db_beanie ), for MongoDB ObjectID. Inheritance order matters Notice in your example that the mixin comes first in our UserManager inheritance . Because of the Method-Resolution-Order (MRO) of Python, the left-most element takes precedence. If you need another type of ID, you can simply overload the parse_id method on your UserManager class: from fastapi_users import BaseUserManager , InvalidID class UserManager ( BaseUserManager [ User , MyCustomID ]): def parse_id ( self , value : Any ) -> MyCustomID : try : return MyCustomID ( value ) except ValueError as e : raise InvalidID () from e # (1)! If the ID can't be parsed into the desired type, you'll need to raise an InvalidID exception.","title":"The ID parser mixin"},{"location":"configuration/user-manager/#create-get_user_manager-dependency","text":"The UserManager class will be injected at runtime using a FastAPI dependency. This way, you can run it in a database session or swap it with a mock during testing. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) Notice that we use the get_user_db dependency we defined earlier to inject the database instance.","title":"Create get_user_manager dependency"},{"location":"configuration/user-manager/#customize-attributes-and-methods","text":"","title":"Customize attributes and methods"},{"location":"configuration/user-manager/#attributes","text":"reset_password_token_secret : Secret to encode reset password token. Use a strong passphrase and keep it secure. reset_password_token_lifetime_seconds : Lifetime of reset password token. Defaults to 3600. reset_password_token_audience : JWT audience of reset password token. Defaults to fastapi-users:reset . verification_token_secret : Secret to encode verification token. Use a strong passphrase and keep it secure. verification_token_lifetime_seconds : Lifetime of verification token. Defaults to 3600. verification_token_audience : JWT audience of verification token. Defaults to fastapi-users:verify .","title":"Attributes"},{"location":"configuration/user-manager/#methods","text":"","title":"Methods"},{"location":"configuration/user-manager/#validate_password","text":"Validate a password. Arguments password ( str ): the password to validate. user ( Union[UserCreate, User] ): user model which we are currently validating the password. Useful if you want to check that the password doesn't contain the name or the birthdate of the user for example. Output This function should return None if the password is valid or raise InvalidPasswordException if not. This exception expects an argument reason telling why the password is invalid. It'll be part of the error response. Example from fastapi_users import BaseUserManager , InvalidPasswordException , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def validate_password ( self , password : str , user : Union [ UserCreate , User ], ) -> None : if len ( password ) < 8 : raise InvalidPasswordException ( reason = \"Password should be at least 8 characters\" ) if user . email in password : raise InvalidPasswordException ( reason = \"Password should not contain e-mail\" )","title":"validate_password"},{"location":"configuration/user-manager/#on_after_register","text":"Perform logic after successful user registration. Typically, you'll want to send a welcome e-mail or add it to your marketing analytics pipeline. Arguments user ( User ): the registered user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" )","title":"on_after_register"},{"location":"configuration/user-manager/#on_after_update","text":"Perform logic after successful user update. It may be useful, for example, if you wish to update your user in a data analytics or customer success platform. Arguments user ( User ): the updated user. update_dict ( Dict[str, Any] ): dictionary with the updated user fields. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_update ( self , user : User , update_dict : Dict [ str , Any ], request : Optional [ Request ] = None , ): print ( f \"User { user . id } has been updated with { update_dict } .\" )","title":"on_after_update"},{"location":"configuration/user-manager/#on_after_login","text":"Perform logic after a successful user login. It may be useful for custom logic or processes triggered by new logins, for example a daily login reward or for analytics. Arguments user ( User ): the updated user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_login ( self , user : User , request : Optional [ Request ] = None , ): print ( f \"User { user . id } logged in.\" )","title":"on_after_login"},{"location":"configuration/user-manager/#on_after_request_verify","text":"Perform logic after successful verification request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to verify their e-mail. Arguments user ( User ): the user to verify. token ( str ): the verification token. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" )","title":"on_after_request_verify"},{"location":"configuration/user-manager/#on_after_verify","text":"Perform logic after successful user verification. This may be useful if you wish to send another e-mail or store this information in a data analytics or customer success platform. Arguments user ( User ): the verified user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_verify ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has been verified\" )","title":"on_after_verify"},{"location":"configuration/user-manager/#on_after_forgot_password","text":"Perform logic after successful forgot password request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to reset their password. Arguments user ( User ): the user that forgot its password. token ( str ): the forgot password token request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" )","title":"on_after_forgot_password"},{"location":"configuration/user-manager/#on_after_reset_password","text":"Perform logic after successful password reset. For example, you may want to send an e-mail to the concerned user to warn him that their password has been changed and that they should take action if they think they have been hacked. Arguments user ( User ): the user that reset its password. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_reset_password ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has reset their password.\" )","title":"on_after_reset_password"},{"location":"configuration/user-manager/#on_before_delete","text":"Perform logic before user delete. For example, you may want to valide user resource integrity to see if any related user resource need to be marked inactive, or delete them recursively. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_before_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is going to be deleted\" )","title":"on_before_delete"},{"location":"configuration/user-manager/#on_after_delete","text":"Perform logic after user delete. For example, you may want to send an email to the administrator about the event. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is successfully deleted\" )","title":"on_after_delete"},{"location":"configuration/authentication/","text":"Authentication \u00b6 FastAPI Users allows you to plug in several authentication methods. How it works? \u00b6 You can have several authentication methods, e.g. a cookie authentication for browser-based queries and a JWT token authentication for pure API queries. When checking authentication, each method is run one after the other. The first method yielding a user wins. If no method yields a user, an HTTPException is raised. For each backend, you'll be able to add a router with the corresponding /login and /logout . More on this in the routers documentation . Transport + Strategy = Authentication backend \u00b6 An authentication backend is composed of two parts: Transport \u00b6 It manages how the token will be carried over the request. We currently provide two methods: Bearer \u00b6 The token will be send through an Authorization: Bearer header. Pros and cons \u2705 Easy to read and set in every requests. \u274c Needs to be stored manually somewhere in the client. \u27a1\ufe0f Use it if you want to implement a mobile application or a pure REST API. Cookie \u00b6 The token will be send through a cookie. Pros and cons \u2705 Automatically stored and sent securely by web browsers in every requests. \u2705 Automatically removed at expiration by web browsers. \u274c Needs a CSRF protection for maximum security. \u274c Harder to work with outside a browser, like a mobile app or a server. \u27a1\ufe0f Use it if you want to implement a web frontend. Strategy \u00b6 It manages how the token is generated and secured. We currently provide two methods: JWT \u00b6 The token is self-contained in a JSON Web Token. Pros and cons \u2705 Self-contained: it doesn't need to be stored in a database. \u274c Can't be invalidated on the server-side: it's valid until it expires. \u27a1\ufe0f Use it if you want to get up-and-running quickly. Database \u00b6 The token is stored in a table (or collection) in your database. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from the database. \u2705 Highly customizable: add your own fields, create an API to retrieve the active sessions of your users, etc. \u274c Configuration is a bit more complex. \u27a1\ufe0f Use it if you want maximum flexibility in your token management. Redis \u00b6 The token is stored in a Redis key-store. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from Redis. \u274c A Redis server is needed. \u27a1\ufe0f Use it if you want maximum performance while being able to invalidate tokens.","title":"Introduction"},{"location":"configuration/authentication/#authentication","text":"FastAPI Users allows you to plug in several authentication methods.","title":"Authentication"},{"location":"configuration/authentication/#how-it-works","text":"You can have several authentication methods, e.g. a cookie authentication for browser-based queries and a JWT token authentication for pure API queries. When checking authentication, each method is run one after the other. The first method yielding a user wins. If no method yields a user, an HTTPException is raised. For each backend, you'll be able to add a router with the corresponding /login and /logout . More on this in the routers documentation .","title":"How it works?"},{"location":"configuration/authentication/#transport-strategy-authentication-backend","text":"An authentication backend is composed of two parts:","title":"Transport + Strategy = Authentication backend"},{"location":"configuration/authentication/#transport","text":"It manages how the token will be carried over the request. We currently provide two methods:","title":"Transport"},{"location":"configuration/authentication/#bearer","text":"The token will be send through an Authorization: Bearer header. Pros and cons \u2705 Easy to read and set in every requests. \u274c Needs to be stored manually somewhere in the client. \u27a1\ufe0f Use it if you want to implement a mobile application or a pure REST API.","title":"Bearer"},{"location":"configuration/authentication/#cookie","text":"The token will be send through a cookie. Pros and cons \u2705 Automatically stored and sent securely by web browsers in every requests. \u2705 Automatically removed at expiration by web browsers. \u274c Needs a CSRF protection for maximum security. \u274c Harder to work with outside a browser, like a mobile app or a server. \u27a1\ufe0f Use it if you want to implement a web frontend.","title":"Cookie"},{"location":"configuration/authentication/#strategy","text":"It manages how the token is generated and secured. We currently provide two methods:","title":"Strategy"},{"location":"configuration/authentication/#jwt","text":"The token is self-contained in a JSON Web Token. Pros and cons \u2705 Self-contained: it doesn't need to be stored in a database. \u274c Can't be invalidated on the server-side: it's valid until it expires. \u27a1\ufe0f Use it if you want to get up-and-running quickly.","title":"JWT"},{"location":"configuration/authentication/#database","text":"The token is stored in a table (or collection) in your database. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from the database. \u2705 Highly customizable: add your own fields, create an API to retrieve the active sessions of your users, etc. \u274c Configuration is a bit more complex. \u27a1\ufe0f Use it if you want maximum flexibility in your token management.","title":"Database"},{"location":"configuration/authentication/#redis","text":"The token is stored in a Redis key-store. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from Redis. \u274c A Redis server is needed. \u27a1\ufe0f Use it if you want maximum performance while being able to invalidate tokens.","title":"Redis"},{"location":"configuration/authentication/backend/","text":"Create a backend \u00b6 As we said, a backend is the combination of a transport and a strategy. That way, you can create a complete strategy exactly fitting your needs. For this, you have to use the AuthenticationBackend class. from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) As you can see, instantiation is quite simple. It accepts the following arguments: name ( str ): Name of the backend. Each backend should have a unique name. transport ( Transport ): An instance of a Transport class. get_strategy ( Callable[..., Strategy] ): A dependency callable returning an instance of a Strategy class. Next steps \u00b6 You can have as many authentication backends as you wish. You'll then have to pass those backends to your FastAPIUsers instance and generate an auth router for each one of them.","title":"Create a backend"},{"location":"configuration/authentication/backend/#create-a-backend","text":"As we said, a backend is the combination of a transport and a strategy. That way, you can create a complete strategy exactly fitting your needs. For this, you have to use the AuthenticationBackend class. from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) As you can see, instantiation is quite simple. It accepts the following arguments: name ( str ): Name of the backend. Each backend should have a unique name. transport ( Transport ): An instance of a Transport class. get_strategy ( Callable[..., Strategy] ): A dependency callable returning an instance of a Strategy class.","title":"Create a backend"},{"location":"configuration/authentication/backend/#next-steps","text":"You can have as many authentication backends as you wish. You'll then have to pass those backends to your FastAPIUsers instance and generate an auth router for each one of them.","title":"Next steps"},{"location":"configuration/authentication/strategies/database/","text":"Database \u00b6 The most natural way for storing tokens is of course the very same database you're using for your application. In this strategy, we set up a table (or collection) for storing those tokens with the associated user id. On each request, we try to retrive this token from the database to get the corresponding user id. Configuration \u00b6 The configuration of this strategy is a bit more complex than the others as it requires you to configure models and a database adapter, exactly like we did for users . Database adapters \u00b6 An access token will be structured like this in your database: token ( str ) \u2013 Unique identifier of the token. It's generated automatically upon login by the strategy. user_id ( ID ) \u2013 User id. of the user associated to this token. created_at ( datetime ) \u2013 Date and time of creation of the token. It's used to determine if the token is expired or not. We are providing a base model with those fields for each database we are supporting. SQLAlchemy \u00b6 We'll expand from the basic SQLAlchemy configuration. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from fastapi_users_db_sqlalchemy.access_token import ( SQLAlchemyAccessTokenDatabase , SQLAlchemyBaseAccessTokenTableUUID , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass class AccessToken ( SQLAlchemyBaseAccessTokenTableUUID , Base ): # (1)! pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) async def get_access_token_db ( session : AsyncSession = Depends ( get_async_session ), ): # (2)! yield SQLAlchemyAccessTokenDatabase ( session , AccessToken ) We define an AccessToken ORM model inheriting from SQLAlchemyBaseAccessTokenTableUUID . We define a dependency to instantiate the SQLAlchemyAccessTokenDatabase class. Just like the user database adapter, it expects a fresh SQLAlchemy session and the AccessToken model class we defined above. user_id foreign key is defined as UUID By default, we use UUID as a primary key ID for your user, so we follow the same convention to define the foreign key pointing to the user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseAccessTokenTable as base class and define your own user_id column. class AccessToken ( SQLAlchemyBaseAccessTokenTable [ int ], Base ): @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseAccessTokenTable expects a generic type to define the actual type of ID you use. Beanie \u00b6 We'll expand from the basic Beanie configuration. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase from fastapi_users_db_beanie.access_token import ( BeanieAccessTokenDatabase , BeanieBaseAccessToken , ) DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser ): pass class AccessToken ( BeanieBaseAccessToken [ PydanticObjectId ]): # (1)! pass async def get_user_db (): yield BeanieUserDatabase ( User ) async def get_access_token_db (): # (2)! yield BeanieAccessTokenDatabase ( AccessToken ) We define an AccessToken ODM model inheriting from BeanieBaseAccessToken . Notice that we set a generic type to define the type of the user_id reference. By default, it's a standard MongoDB ObjectID. We define a dependency to instantiate the BeanieAccessTokenDatabase class. Just like the user database adapter, it expects the AccessToken model class we defined above. Strategy \u00b6 import uuid from fastapi import Depends from fastapi_users.authentication.strategy.db import AccessTokenDatabase , DatabaseStrategy from .db import AccessToken , User def get_database_strategy ( access_token_db : AccessTokenDatabase [ AccessToken ] = Depends ( get_access_token_db ), ) -> DatabaseStrategy : return DatabaseStrategy ( access_token_db , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: database ( AccessTokenDatabase ): A database adapter instance for AccessToken table, like we defined above. lifetime_seconds ( int ): The lifetime of the token in seconds. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. As you can see here, this pattern allows us to dynamically inject a connection to the database. Logout \u00b6 On logout, this strategy will delete the token from the database.","title":"Database"},{"location":"configuration/authentication/strategies/database/#database","text":"The most natural way for storing tokens is of course the very same database you're using for your application. In this strategy, we set up a table (or collection) for storing those tokens with the associated user id. On each request, we try to retrive this token from the database to get the corresponding user id.","title":"Database"},{"location":"configuration/authentication/strategies/database/#configuration","text":"The configuration of this strategy is a bit more complex than the others as it requires you to configure models and a database adapter, exactly like we did for users .","title":"Configuration"},{"location":"configuration/authentication/strategies/database/#database-adapters","text":"An access token will be structured like this in your database: token ( str ) \u2013 Unique identifier of the token. It's generated automatically upon login by the strategy. user_id ( ID ) \u2013 User id. of the user associated to this token. created_at ( datetime ) \u2013 Date and time of creation of the token. It's used to determine if the token is expired or not. We are providing a base model with those fields for each database we are supporting.","title":"Database adapters"},{"location":"configuration/authentication/strategies/database/#sqlalchemy","text":"We'll expand from the basic SQLAlchemy configuration. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from fastapi_users_db_sqlalchemy.access_token import ( SQLAlchemyAccessTokenDatabase , SQLAlchemyBaseAccessTokenTableUUID , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass class AccessToken ( SQLAlchemyBaseAccessTokenTableUUID , Base ): # (1)! pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) async def get_access_token_db ( session : AsyncSession = Depends ( get_async_session ), ): # (2)! yield SQLAlchemyAccessTokenDatabase ( session , AccessToken ) We define an AccessToken ORM model inheriting from SQLAlchemyBaseAccessTokenTableUUID . We define a dependency to instantiate the SQLAlchemyAccessTokenDatabase class. Just like the user database adapter, it expects a fresh SQLAlchemy session and the AccessToken model class we defined above. user_id foreign key is defined as UUID By default, we use UUID as a primary key ID for your user, so we follow the same convention to define the foreign key pointing to the user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseAccessTokenTable as base class and define your own user_id column. class AccessToken ( SQLAlchemyBaseAccessTokenTable [ int ], Base ): @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseAccessTokenTable expects a generic type to define the actual type of ID you use.","title":"SQLAlchemy"},{"location":"configuration/authentication/strategies/database/#beanie","text":"We'll expand from the basic Beanie configuration. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase from fastapi_users_db_beanie.access_token import ( BeanieAccessTokenDatabase , BeanieBaseAccessToken , ) DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser ): pass class AccessToken ( BeanieBaseAccessToken [ PydanticObjectId ]): # (1)! pass async def get_user_db (): yield BeanieUserDatabase ( User ) async def get_access_token_db (): # (2)! yield BeanieAccessTokenDatabase ( AccessToken ) We define an AccessToken ODM model inheriting from BeanieBaseAccessToken . Notice that we set a generic type to define the type of the user_id reference. By default, it's a standard MongoDB ObjectID. We define a dependency to instantiate the BeanieAccessTokenDatabase class. Just like the user database adapter, it expects the AccessToken model class we defined above.","title":"Beanie"},{"location":"configuration/authentication/strategies/database/#strategy","text":"import uuid from fastapi import Depends from fastapi_users.authentication.strategy.db import AccessTokenDatabase , DatabaseStrategy from .db import AccessToken , User def get_database_strategy ( access_token_db : AccessTokenDatabase [ AccessToken ] = Depends ( get_access_token_db ), ) -> DatabaseStrategy : return DatabaseStrategy ( access_token_db , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: database ( AccessTokenDatabase ): A database adapter instance for AccessToken table, like we defined above. lifetime_seconds ( int ): The lifetime of the token in seconds. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. As you can see here, this pattern allows us to dynamically inject a connection to the database.","title":"Strategy"},{"location":"configuration/authentication/strategies/database/#logout","text":"On logout, this strategy will delete the token from the database.","title":"Logout"},{"location":"configuration/authentication/strategies/jwt/","text":"JWT \u00b6 JSON Web Token (JWT) is an internet standard for creating access tokens based on JSON. They don't need to be stored in a database: the data is self-contained inside and cryptographically signed. Configuration \u00b6 from fastapi_users.authentication import JWTStrategy SECRET = \"SECRET\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: secret ( Union[str, pydantic.SecretStr] ): A constant secret which is used to encode the token. Use a strong passphrase and keep it secure. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Can be set to None but in this case the token will be valid forever ; which may raise serious security concerns. token_audience ( Optional[List[str]] ): A list of valid audiences for the JWT token. Defaults to [\"fastapi-users:auth\"] . algorithm ( Optional[str] ): The JWT encryption algorithm. See RFC 7519, section 8 . Defaults to \"HS256\" . public_key ( Optional[Union[str, pydantic.SecretStr]] ): If the JWT encryption algorithm requires a key pair instead of a simple secret, the key to decrypt the JWT may be provided here. The secret parameter will always be used to encrypt the JWT. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. For JWTStrategy , since it doesn't require dependencies, it can be as simple as the function above. RS256 example \u00b6 from fastapi_users.authentication import JWTStrategy PUBLIC_KEY = \"\"\"-----BEGIN PUBLIC KEY----- # Your RSA public key in PEM format goes here -----END PUBLIC KEY-----\"\"\" PRIVATE_KEY = \"\"\"-----BEGIN RSA PRIVATE KEY----- # Your RSA private key in PEM format goes here -----END RSA PRIVATE KEY-----\"\"\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = PRIVATE_KEY , lifetime_seconds = 3600 , algorithm = \"RS256\" , public_key = PUBLIC_KEY , ) Logout \u00b6 On logout, this strategy won't do anything . Indeed, a JWT can't be invalidated on the server-side: it's valid until it expires.","title":"JWT"},{"location":"configuration/authentication/strategies/jwt/#jwt","text":"JSON Web Token (JWT) is an internet standard for creating access tokens based on JSON. They don't need to be stored in a database: the data is self-contained inside and cryptographically signed.","title":"JWT"},{"location":"configuration/authentication/strategies/jwt/#configuration","text":"from fastapi_users.authentication import JWTStrategy SECRET = \"SECRET\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: secret ( Union[str, pydantic.SecretStr] ): A constant secret which is used to encode the token. Use a strong passphrase and keep it secure. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Can be set to None but in this case the token will be valid forever ; which may raise serious security concerns. token_audience ( Optional[List[str]] ): A list of valid audiences for the JWT token. Defaults to [\"fastapi-users:auth\"] . algorithm ( Optional[str] ): The JWT encryption algorithm. See RFC 7519, section 8 . Defaults to \"HS256\" . public_key ( Optional[Union[str, pydantic.SecretStr]] ): If the JWT encryption algorithm requires a key pair instead of a simple secret, the key to decrypt the JWT may be provided here. The secret parameter will always be used to encrypt the JWT. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. For JWTStrategy , since it doesn't require dependencies, it can be as simple as the function above.","title":"Configuration"},{"location":"configuration/authentication/strategies/jwt/#rs256-example","text":"from fastapi_users.authentication import JWTStrategy PUBLIC_KEY = \"\"\"-----BEGIN PUBLIC KEY----- # Your RSA public key in PEM format goes here -----END PUBLIC KEY-----\"\"\" PRIVATE_KEY = \"\"\"-----BEGIN RSA PRIVATE KEY----- # Your RSA private key in PEM format goes here -----END RSA PRIVATE KEY-----\"\"\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = PRIVATE_KEY , lifetime_seconds = 3600 , algorithm = \"RS256\" , public_key = PUBLIC_KEY , )","title":"RS256 example"},{"location":"configuration/authentication/strategies/jwt/#logout","text":"On logout, this strategy won't do anything . Indeed, a JWT can't be invalidated on the server-side: it's valid until it expires.","title":"Logout"},{"location":"configuration/authentication/strategies/redis/","text":"Redis \u00b6 Redis is an ultra-fast key-store database. As such, it's a good candidate for token management. In this strategy, a token is generated and associated with the user id. in the database. On each request, we try to retrieve this token from Redis to get the corresponding user id. Installation \u00b6 You should install the library with the optional dependencies for Redis: pip install 'fastapi-users[redis]' Configuration \u00b6 import redis.asyncio from fastapi_users.authentication import RedisStrategy redis = redis . asyncio . from_url ( \"redis://localhost:6379\" , decode_responses = True ) def get_redis_strategy () -> RedisStrategy : return RedisStrategy ( redis , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: redis ( redis.asyncio.Redis ): An instance of redis.asyncio.Redis . Note that the decode_responses flag set to True is necessary. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Defaults to None , which means the token doesn't expire. key_prefix ( str ): The prefix used to set the key in the Redis stored. Defaults to fastapi_users_token: . Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. Logout \u00b6 On logout, this strategy will delete the token from the Redis store.","title":"Redis"},{"location":"configuration/authentication/strategies/redis/#redis","text":"Redis is an ultra-fast key-store database. As such, it's a good candidate for token management. In this strategy, a token is generated and associated with the user id. in the database. On each request, we try to retrieve this token from Redis to get the corresponding user id.","title":"Redis"},{"location":"configuration/authentication/strategies/redis/#installation","text":"You should install the library with the optional dependencies for Redis: pip install 'fastapi-users[redis]'","title":"Installation"},{"location":"configuration/authentication/strategies/redis/#configuration","text":"import redis.asyncio from fastapi_users.authentication import RedisStrategy redis = redis . asyncio . from_url ( \"redis://localhost:6379\" , decode_responses = True ) def get_redis_strategy () -> RedisStrategy : return RedisStrategy ( redis , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: redis ( redis.asyncio.Redis ): An instance of redis.asyncio.Redis . Note that the decode_responses flag set to True is necessary. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Defaults to None , which means the token doesn't expire. key_prefix ( str ): The prefix used to set the key in the Redis stored. Defaults to fastapi_users_token: . Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend.","title":"Configuration"},{"location":"configuration/authentication/strategies/redis/#logout","text":"On logout, this strategy will delete the token from the Redis store.","title":"Logout"},{"location":"configuration/authentication/transports/bearer/","text":"Bearer \u00b6 With this transport, the token is expected inside the Authorization header of the HTTP request with the Bearer scheme. It's particularly suited for pure API interaction or mobile apps. Configuration \u00b6 from fastapi_users.authentication import BearerTransport bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) As you can see, instantiation is quite simple. It accepts the following arguments: tokenUrl ( str ): The exact path of your login endpoint. It'll allow the interactive documentation to automatically discover it and get a working Authorize button. In most cases, you'll probably need a relative path, not absolute. You can read more details about this in the FastAPI documentation . Login \u00b6 This method will return the in the following form upon successful login: 200 OK { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Check documentation about login route . Logout \u00b6 The logout method with this transport returns nothing. Authentication \u00b6 This method expects that you provide a Bearer authentication with a valid token corresponding to your strategy. curl http://localhost:9000/protected-route -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI'","title":"Bearer"},{"location":"configuration/authentication/transports/bearer/#bearer","text":"With this transport, the token is expected inside the Authorization header of the HTTP request with the Bearer scheme. It's particularly suited for pure API interaction or mobile apps.","title":"Bearer"},{"location":"configuration/authentication/transports/bearer/#configuration","text":"from fastapi_users.authentication import BearerTransport bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) As you can see, instantiation is quite simple. It accepts the following arguments: tokenUrl ( str ): The exact path of your login endpoint. It'll allow the interactive documentation to automatically discover it and get a working Authorize button. In most cases, you'll probably need a relative path, not absolute. You can read more details about this in the FastAPI documentation .","title":"Configuration"},{"location":"configuration/authentication/transports/bearer/#login","text":"This method will return the in the following form upon successful login: 200 OK { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Check documentation about login route .","title":"Login"},{"location":"configuration/authentication/transports/bearer/#logout","text":"The logout method with this transport returns nothing.","title":"Logout"},{"location":"configuration/authentication/transports/bearer/#authentication","text":"This method expects that you provide a Bearer authentication with a valid token corresponding to your strategy. curl http://localhost:9000/protected-route -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI'","title":"Authentication"},{"location":"configuration/authentication/transports/cookie/","text":"Cookie \u00b6 Cookies are an easy way to store stateful information into the user browser. Thus, it is more useful for browser-based navigation (e.g. a front-end app making API requests) rather than pure API interaction. Configuration \u00b6 from fastapi_users.authentication import CookieTransport cookie_transport = CookieTransport ( cookie_max_age = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: cookie_name ( fastapiusersauth ): Name of the cookie. cookie_max_age ( Optional[int] ): The lifetime of the cookie in seconds. None by default, which means it's a session cookie. cookie_path ( / ): Cookie path. cookie_domain ( None ): Cookie domain. cookie_secure ( True ): Whether to only send the cookie to the server via SSL request. cookie_httponly ( True ): Whether to prevent access to the cookie via JavaScript. cookie_samesite ( lax ): A string that specifies the samesite strategy for the cookie. Valid values are lax , strict and none . Defaults to lax . Login \u00b6 This method will return a response with a valid set-cookie header upon successful login: 200 OK Check documentation about login route . Logout \u00b6 This method will remove the authentication cookie: 200 OK Check documentation about logout route . Authentication \u00b6 This method expects that you provide a valid cookie in the headers.","title":"Cookie"},{"location":"configuration/authentication/transports/cookie/#cookie","text":"Cookies are an easy way to store stateful information into the user browser. Thus, it is more useful for browser-based navigation (e.g. a front-end app making API requests) rather than pure API interaction.","title":"Cookie"},{"location":"configuration/authentication/transports/cookie/#configuration","text":"from fastapi_users.authentication import CookieTransport cookie_transport = CookieTransport ( cookie_max_age = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: cookie_name ( fastapiusersauth ): Name of the cookie. cookie_max_age ( Optional[int] ): The lifetime of the cookie in seconds. None by default, which means it's a session cookie. cookie_path ( / ): Cookie path. cookie_domain ( None ): Cookie domain. cookie_secure ( True ): Whether to only send the cookie to the server via SSL request. cookie_httponly ( True ): Whether to prevent access to the cookie via JavaScript. cookie_samesite ( lax ): A string that specifies the samesite strategy for the cookie. Valid values are lax , strict and none . Defaults to lax .","title":"Configuration"},{"location":"configuration/authentication/transports/cookie/#login","text":"This method will return a response with a valid set-cookie header upon successful login: 200 OK Check documentation about login route .","title":"Login"},{"location":"configuration/authentication/transports/cookie/#logout","text":"This method will remove the authentication cookie: 200 OK Check documentation about logout route .","title":"Logout"},{"location":"configuration/authentication/transports/cookie/#authentication","text":"This method expects that you provide a valid cookie in the headers.","title":"Authentication"},{"location":"configuration/databases/beanie/","text":"Beanie \u00b6 FastAPI Users provides the necessary tools to work with MongoDB databases using the Beanie ODM . Setup database connection and collection \u00b6 The first thing to do is to create a MongoDB connection using mongodb/motor (automatically installed with Beanie). import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) You can choose any name for the database. Create the User model \u00b6 As for any Beanie ODM model, we'll create a User model. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Document ID is a MongoDB ObjectID Beanie automatically manages document ID by encoding/decoding MongoDB ObjectID. If you want to use another type, like UUID, you can override the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Notice that BeanieBaseUser expects a generic type to define the actual type of ID you use. Info The base class is configured to automatically create a unique index on id and email . Create the database adapter \u00b6 The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) Notice that we pass a reference to the User model we defined above. Initialize Beanie \u00b6 When initializing your FastAPI app, it's important that you initialize Beanie so it can discover your models. We can achieve this using a startup event handler on the FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , # (1)! document_models = [ User , # (2)! ], ) This is the db Motor database instance we defined above. This is the Beanie User model we defined above. Don't forget to also add your very own models!","title":"Beanie"},{"location":"configuration/databases/beanie/#beanie","text":"FastAPI Users provides the necessary tools to work with MongoDB databases using the Beanie ODM .","title":"Beanie"},{"location":"configuration/databases/beanie/#setup-database-connection-and-collection","text":"The first thing to do is to create a MongoDB connection using mongodb/motor (automatically installed with Beanie). import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) You can choose any name for the database.","title":"Setup database connection and collection"},{"location":"configuration/databases/beanie/#create-the-user-model","text":"As for any Beanie ODM model, we'll create a User model. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Document ID is a MongoDB ObjectID Beanie automatically manages document ID by encoding/decoding MongoDB ObjectID. If you want to use another type, like UUID, you can override the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Notice that BeanieBaseUser expects a generic type to define the actual type of ID you use. Info The base class is configured to automatically create a unique index on id and email .","title":"Create the User model"},{"location":"configuration/databases/beanie/#create-the-database-adapter","text":"The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) Notice that we pass a reference to the User model we defined above.","title":"Create the database adapter"},{"location":"configuration/databases/beanie/#initialize-beanie","text":"When initializing your FastAPI app, it's important that you initialize Beanie so it can discover your models. We can achieve this using a startup event handler on the FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , # (1)! document_models = [ User , # (2)! ], ) This is the db Motor database instance we defined above. This is the Beanie User model we defined above. Don't forget to also add your very own models!","title":"Initialize Beanie"},{"location":"configuration/databases/sqlalchemy/","text":"SQLAlchemy \u00b6 FastAPI Users provides the necessary tools to work with SQL databases thanks to SQLAlchemy ORM with asyncio . Asynchronous driver \u00b6 To work with your DBMS, you'll need to install the corresponding asyncio driver. The common choices are: For PostgreSQL: pip install asyncpg For SQLite: pip install aiosqlite Examples of DB_URL s are: PostgreSQL: engine = create_engine('postgresql+asyncpg://user:password@host:port/name') SQLite: engine = create_engine('sqlite+aiosqlite:///name.db') For the sake of this tutorial from now on, we'll use a simple SQLite database. Create the User model \u00b6 As for any SQLAlchemy ORM model, we'll create a User model. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseUserTable as base class and define your own id column. class User ( SQLAlchemyBaseUserTable [ int ], Base ): id = Column ( Integer , primary_key = True ) Notice that SQLAlchemyBaseUserTable expects a generic type to define the actual type of ID you use. Implement a function to create the tables \u00b6 We'll now create an utility function to create all the defined tables. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) This function can be called, for example, during the initialization of your FastAPI app. Warning In production, it's strongly recommended to setup a migration system to update your SQL schemas. See Alembic . Create the database adapter dependency \u00b6 The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) Notice that we define first a get_async_session dependency returning us a fresh SQLAlchemy session to interact with the database. It's then used inside the get_user_db dependency to generate our adapter. Notice that we pass it two things: The session instance we just injected. The User class, which is the actual SQLAlchemy model.","title":"SQLAlchemy"},{"location":"configuration/databases/sqlalchemy/#sqlalchemy","text":"FastAPI Users provides the necessary tools to work with SQL databases thanks to SQLAlchemy ORM with asyncio .","title":"SQLAlchemy"},{"location":"configuration/databases/sqlalchemy/#asynchronous-driver","text":"To work with your DBMS, you'll need to install the corresponding asyncio driver. The common choices are: For PostgreSQL: pip install asyncpg For SQLite: pip install aiosqlite Examples of DB_URL s are: PostgreSQL: engine = create_engine('postgresql+asyncpg://user:password@host:port/name') SQLite: engine = create_engine('sqlite+aiosqlite:///name.db') For the sake of this tutorial from now on, we'll use a simple SQLite database.","title":"Asynchronous driver"},{"location":"configuration/databases/sqlalchemy/#create-the-user-model","text":"As for any SQLAlchemy ORM model, we'll create a User model. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseUserTable as base class and define your own id column. class User ( SQLAlchemyBaseUserTable [ int ], Base ): id = Column ( Integer , primary_key = True ) Notice that SQLAlchemyBaseUserTable expects a generic type to define the actual type of ID you use.","title":"Create the User model"},{"location":"configuration/databases/sqlalchemy/#implement-a-function-to-create-the-tables","text":"We'll now create an utility function to create all the defined tables. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) This function can be called, for example, during the initialization of your FastAPI app. Warning In production, it's strongly recommended to setup a migration system to update your SQL schemas. See Alembic .","title":"Implement a function to create the tables"},{"location":"configuration/databases/sqlalchemy/#create-the-database-adapter-dependency","text":"The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) Notice that we define first a get_async_session dependency returning us a fresh SQLAlchemy session to interact with the database. It's then used inside the get_user_db dependency to generate our adapter. Notice that we pass it two things: The session instance we just injected. The User class, which is the actual SQLAlchemy model.","title":"Create the database adapter dependency"},{"location":"configuration/routers/","text":"Routers \u00b6 We're almost there! The last step is to configure the FastAPIUsers object that will wire the user manager, the authentication classes and let us generate the actual API routes . Configure FastAPIUsers \u00b6 Configure FastAPIUsers object with the elements we defined before. More precisely: get_user_manager : Dependency callable getter to inject the user manager class instance. See UserManager . auth_backends : List of authentication backends. See Authentication . import uuid from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) Typing: User and ID generic types are expected You can see that we define two generic types when instantiating: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion . Available routers \u00b6 This helper class will let you generate useful routers to setup the authentication system. Each of them is optional , so you can pick only the one that you are interested in! Here are the routers provided: Auth router : Provides /login and /logout routes for a given authentication backend . Register router : Provides /register routes to allow a user to create a new account. Reset password router : Provides /forgot-password and /reset-password routes to allow a user to reset its password. Verify router : Provides /request-verify-token and /verify routes to manage user e-mail verification. Users router : Provides routes to manage users. OAuth router : Provides routes to perform an OAuth authentication against a service provider (like Google or Facebook). You should check out each of them to understand how to use them.","title":"Introduction"},{"location":"configuration/routers/#routers","text":"We're almost there! The last step is to configure the FastAPIUsers object that will wire the user manager, the authentication classes and let us generate the actual API routes .","title":"Routers"},{"location":"configuration/routers/#configure-fastapiusers","text":"Configure FastAPIUsers object with the elements we defined before. More precisely: get_user_manager : Dependency callable getter to inject the user manager class instance. See UserManager . auth_backends : List of authentication backends. See Authentication . import uuid from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) Typing: User and ID generic types are expected You can see that we define two generic types when instantiating: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion .","title":"Configure FastAPIUsers"},{"location":"configuration/routers/#available-routers","text":"This helper class will let you generate useful routers to setup the authentication system. Each of them is optional , so you can pick only the one that you are interested in! Here are the routers provided: Auth router : Provides /login and /logout routes for a given authentication backend . Register router : Provides /register routes to allow a user to create a new account. Reset password router : Provides /forgot-password and /reset-password routes to allow a user to reset its password. Verify router : Provides /request-verify-token and /verify routes to manage user e-mail verification. Users router : Provides routes to manage users. OAuth router : Provides routes to perform an OAuth authentication against a service provider (like Google or Facebook). You should check out each of them to understand how to use them.","title":"Available routers"},{"location":"configuration/routers/auth/","text":"Auth router \u00b6 The auth router will generate /login and /logout routes for a given authentication backend . Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], ) Optional: user verification \u00b6 You can require the user to be verified (i.e. is_verified property set to True ) to allow login. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_auth_router ( auth_backend , requires_verification = True ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], )","title":"Auth router"},{"location":"configuration/routers/auth/#auth-router","text":"The auth router will generate /login and /logout routes for a given authentication backend . Check the routes usage to learn how to use them.","title":"Auth router"},{"location":"configuration/routers/auth/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"configuration/routers/auth/#optional-user-verification","text":"You can require the user to be verified (i.e. is_verified property set to True ) to allow login. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_auth_router ( auth_backend , requires_verification = True ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], )","title":"Optional: user verification"},{"location":"configuration/routers/register/","text":"Register routes \u00b6 The register router will generate a /register route to allow a user to create a new account. Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserCreate , UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Register routes"},{"location":"configuration/routers/register/#register-routes","text":"The register router will generate a /register route to allow a user to create a new account. Check the routes usage to learn how to use them.","title":"Register routes"},{"location":"configuration/routers/register/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserCreate , UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"configuration/routers/reset/","text":"Reset password router \u00b6 The reset password router will generate /forgot-password (the user asks for a token to reset its password) and /reset-password (the user changes its password given the token) routes. Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Reset password router"},{"location":"configuration/routers/reset/#reset-password-router","text":"The reset password router will generate /forgot-password (the user asks for a token to reset its password) and /reset-password (the user changes its password given the token) routes. Check the routes usage to learn how to use them.","title":"Reset password router"},{"location":"configuration/routers/reset/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"configuration/routers/users/","text":"Users router \u00b6 This router provides routes to manage users. Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead , UserUpdate fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) Optional: user verification \u00b6 You can require the user to be verified (i.e. is_verified property set to True ) to access those routes. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate , requires_verification = True ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"Users router"},{"location":"configuration/routers/users/#users-router","text":"This router provides routes to manage users. Check the routes usage to learn how to use them.","title":"Users router"},{"location":"configuration/routers/users/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead , UserUpdate fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"Setup"},{"location":"configuration/routers/users/#optional-user-verification","text":"You can require the user to be verified (i.e. is_verified property set to True ) to access those routes. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate , requires_verification = True ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"Optional: user verification"},{"location":"configuration/routers/verify/","text":"Verify router \u00b6 This router provides routes to manage user email verification. Check the routes usage to learn how to use them. \ud83d\udc4f\ud83d\udc4f\ud83d\udc4f A big thank you to Edd Salkield and Mark Todd who worked hard on this feature! Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Verify router"},{"location":"configuration/routers/verify/#verify-router","text":"This router provides routes to manage user email verification. Check the routes usage to learn how to use them. \ud83d\udc4f\ud83d\udc4f\ud83d\udc4f A big thank you to Edd Salkield and Mark Todd who worked hard on this feature!","title":"Verify router"},{"location":"configuration/routers/verify/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"cookbook/create-user-programmatically/","text":"Create a user programmatically \u00b6 Sometimes, you'll need to create a user programmatically in the code rather than passing by the REST API endpoint. To do this, we'll create a function that you can call from your code. In this context, we are outside the dependency injection mechanism of FastAPI, so we have to take care of instantiating the UserManager class and all other dependent objects manually . For this cookbook, we'll consider you are starting from the SQLAlchemy full example , but it'll be rather similar for other DBMS. 1. Define dependencies as context managers \u00b6 Generally, FastAPI dependencies are defined as generators , using the yield keyword. FastAPI knows very well to handle them inside its dependency injection system. For example, here is the definition of the get_user_manager dependency: async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) In Python, when we want to use a generator, we have to use a for loop, which would be a bit unnatural in this context since we have only one value to get, the user manager instance. To avoid this, we'll transform them into context managers , so we can call them using the with..as syntax. Fortunately, the standard library provides tools to automatically transform generators into context managers. In the following sample, we import our dependencies and create a context manager version using contextlib.asynccontextmanager : import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" ) I have other dependencies Since FastAPI Users fully embraces dependency injection, you may have more arguments passed to your database or user manager dependencies. It's important then to not forget anyone. Once again, outside the dependency injection system, you are responsible of instantiating everything yourself. 2. Write a function \u00b6 We are now ready to write a function. The example below shows you a basic example but you can of course adapt it to your own needs. The key part here is once again to take care of opening every context managers and pass them every required arguments , as the dependency manager would do. import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" ) 3. Use it \u00b6 You can now easily use it in a script. For example: import asyncio if __name__ == \"__main__\" : asyncio . run ( create_user ( \"king.arthur@camelot.bt\" , \"guinevere\" ))","title":"Create a user programmatically"},{"location":"cookbook/create-user-programmatically/#create-a-user-programmatically","text":"Sometimes, you'll need to create a user programmatically in the code rather than passing by the REST API endpoint. To do this, we'll create a function that you can call from your code. In this context, we are outside the dependency injection mechanism of FastAPI, so we have to take care of instantiating the UserManager class and all other dependent objects manually . For this cookbook, we'll consider you are starting from the SQLAlchemy full example , but it'll be rather similar for other DBMS.","title":"Create a user programmatically"},{"location":"cookbook/create-user-programmatically/#1-define-dependencies-as-context-managers","text":"Generally, FastAPI dependencies are defined as generators , using the yield keyword. FastAPI knows very well to handle them inside its dependency injection system. For example, here is the definition of the get_user_manager dependency: async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) In Python, when we want to use a generator, we have to use a for loop, which would be a bit unnatural in this context since we have only one value to get, the user manager instance. To avoid this, we'll transform them into context managers , so we can call them using the with..as syntax. Fortunately, the standard library provides tools to automatically transform generators into context managers. In the following sample, we import our dependencies and create a context manager version using contextlib.asynccontextmanager : import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" ) I have other dependencies Since FastAPI Users fully embraces dependency injection, you may have more arguments passed to your database or user manager dependencies. It's important then to not forget anyone. Once again, outside the dependency injection system, you are responsible of instantiating everything yourself.","title":"1. Define dependencies as context managers"},{"location":"cookbook/create-user-programmatically/#2-write-a-function","text":"We are now ready to write a function. The example below shows you a basic example but you can of course adapt it to your own needs. The key part here is once again to take care of opening every context managers and pass them every required arguments , as the dependency manager would do. import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" )","title":"2. Write a function"},{"location":"cookbook/create-user-programmatically/#3-use-it","text":"You can now easily use it in a script. For example: import asyncio if __name__ == \"__main__\" : asyncio . run ( create_user ( \"king.arthur@camelot.bt\" , \"guinevere\" ))","title":"3. Use it"},{"location":"migration/08_to_1x/","text":"0.8.x \u27a1\ufe0f 1.x.x \u00b6 1.0 version introduces major breaking changes that need you to update some of your code and migrate your data. Id. are UUID \u00b6 Users and OAuth accounts id. are now represented as real UUID objects instead of plain strings. This change was introduced to leverage efficient storage and indexing for DBMS that supports UUID (especially PostgreSQL and Mongo). In Python code \u00b6 If you were doing comparison betwen a user id. and a string (in unit tests for example), you should now cast the id. to string: # Before assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == user . id # Now assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == str ( user . id ) If you were refering to user id. in your Pydantic models, the field should now be of UUID4 type instead of str : from pydantic import BaseModel , UUID4 # Before class Model ( BaseModel ): user_id : str # After class Model ( BaseModel ): user_id : UUID4 MongoDB \u00b6 To avoid any issues, it's recommended to use the standard UUID representation when instantiating the MongoDB client: DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) This parameter controls how the UUID values will be encoded in the database. By default, it's set to pythonLegacy but new applications should consider setting this to standard for cross language compatibility. Read more about this . In database \u00b6 Id. were before stored as strings in the database. You should make a migration to convert string data to UUID data. Danger Scripts below are provided as guidelines. Please review them carefully , adapt them and check that they are working on a test database before applying them to production. BE CAREFUL. THEY CAN DESTROY YOUR DATA. . PostgreSQL \u00b6 PostgreSQL supports UUID type. If not already, you should enable the uuid-ossp extension: CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\" ; To convert the existing id. string column, we can: Create a new column with UUID type. Fill it with the id. converted to UUID. Drop the original id. column. Make the new column a primary key and rename it. ALTER TABLE \"user\" ADD uuid_id UUID ; UPDATE \"user\" SET uuid_id = uuid ( id ); ALTER TABLE \"user\" DROP id ; ALTER TABLE \"user\" ADD PRIMARY KEY ( uuid_id ); ALTER TABLE \"user\" RENAME COLUMN uuid_id TO id ; MySQL \u00b6 MySQL doesn't support UUID type. We'll just convert the column to CHAR(36) type: ALTER TABLE \"user\" MODIFY id CHAR ( 36 ); MongoDB \u00b6 Mongo shell \u00b6 For MongoDB, we can use a forEach iterator to convert the id. for each document: db . getCollection ( 'users' ). find (). forEach ( function ( user ) { var uuid = UUID ( user . id ); db . getCollection ( 'users' ). update ({ _id : user . _id }, [{ $set : { id : uuid }}]); }); Python \u00b6 import uuid import motor.motor_asyncio async def migrate_uuid (): client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] users = db [ \"users\" ] async for user in users . find ({}): await users . update_one ( { \"_id\" : user [ \"_id\" ]}, { \"$set\" : { \"id\" : uuid . UUID ( user [ \"id\" ])}}, ) Splitted routers \u00b6 You now have the responsibility to wire the routers . FastAPI Users doesn't give a bloated users router anymore. Event handlers are also removed. You have to provide your \"after-\" logic as a parameter of the router generator. Before \u00b6 jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . router , prefix = \"/users\" , tags = [ \"users\" ]) @fastapi_users . on_after_register () def on_after_register ( user : User , request : Request ): print ( f \"User { user . id } has registered.\" ) @fastapi_users . on_after_forgot_password () def on_after_forgot_password ( user : User , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) After \u00b6 def on_after_register ( user : UserDB , request : Request ): print ( f \"User { user . id } has registered.\" ) def on_after_forgot_password ( user : UserDB , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . get_auth_router ( jwt_authentication ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( on_after_register ), prefix = \"/auth\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_reset_password_router ( SECRET , after_forgot_password = on_after_forgot_password ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) Important things to notice: FastAPIUsers takes two arguments less ( reset_password_token_secret and reset_password_token_lifetime_seconds ). You have more flexibility to choose the prefix and tags of the routers. The /login / /logout are now your responsibility to include for each backend. The path will change (before /login/jwt , after /jwt/login ). If you don't care about some of those routers, you can discard them.","title":"0.8.x \u27a1\ufe0f 1.x.x"},{"location":"migration/08_to_1x/#08x-1xx","text":"1.0 version introduces major breaking changes that need you to update some of your code and migrate your data.","title":"0.8.x \u27a1\ufe0f 1.x.x"},{"location":"migration/08_to_1x/#id-are-uuid","text":"Users and OAuth accounts id. are now represented as real UUID objects instead of plain strings. This change was introduced to leverage efficient storage and indexing for DBMS that supports UUID (especially PostgreSQL and Mongo).","title":"Id. are UUID"},{"location":"migration/08_to_1x/#in-python-code","text":"If you were doing comparison betwen a user id. and a string (in unit tests for example), you should now cast the id. to string: # Before assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == user . id # Now assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == str ( user . id ) If you were refering to user id. in your Pydantic models, the field should now be of UUID4 type instead of str : from pydantic import BaseModel , UUID4 # Before class Model ( BaseModel ): user_id : str # After class Model ( BaseModel ): user_id : UUID4","title":"In Python code"},{"location":"migration/08_to_1x/#mongodb","text":"To avoid any issues, it's recommended to use the standard UUID representation when instantiating the MongoDB client: DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) This parameter controls how the UUID values will be encoded in the database. By default, it's set to pythonLegacy but new applications should consider setting this to standard for cross language compatibility. Read more about this .","title":"MongoDB"},{"location":"migration/08_to_1x/#in-database","text":"Id. were before stored as strings in the database. You should make a migration to convert string data to UUID data. Danger Scripts below are provided as guidelines. Please review them carefully , adapt them and check that they are working on a test database before applying them to production. BE CAREFUL. THEY CAN DESTROY YOUR DATA. .","title":"In database"},{"location":"migration/08_to_1x/#postgresql","text":"PostgreSQL supports UUID type. If not already, you should enable the uuid-ossp extension: CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\" ; To convert the existing id. string column, we can: Create a new column with UUID type. Fill it with the id. converted to UUID. Drop the original id. column. Make the new column a primary key and rename it. ALTER TABLE \"user\" ADD uuid_id UUID ; UPDATE \"user\" SET uuid_id = uuid ( id ); ALTER TABLE \"user\" DROP id ; ALTER TABLE \"user\" ADD PRIMARY KEY ( uuid_id ); ALTER TABLE \"user\" RENAME COLUMN uuid_id TO id ;","title":"PostgreSQL"},{"location":"migration/08_to_1x/#mysql","text":"MySQL doesn't support UUID type. We'll just convert the column to CHAR(36) type: ALTER TABLE \"user\" MODIFY id CHAR ( 36 );","title":"MySQL"},{"location":"migration/08_to_1x/#mongodb_1","text":"","title":"MongoDB"},{"location":"migration/08_to_1x/#mongo-shell","text":"For MongoDB, we can use a forEach iterator to convert the id. for each document: db . getCollection ( 'users' ). find (). forEach ( function ( user ) { var uuid = UUID ( user . id ); db . getCollection ( 'users' ). update ({ _id : user . _id }, [{ $set : { id : uuid }}]); });","title":"Mongo shell"},{"location":"migration/08_to_1x/#python","text":"import uuid import motor.motor_asyncio async def migrate_uuid (): client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] users = db [ \"users\" ] async for user in users . find ({}): await users . update_one ( { \"_id\" : user [ \"_id\" ]}, { \"$set\" : { \"id\" : uuid . UUID ( user [ \"id\" ])}}, )","title":"Python"},{"location":"migration/08_to_1x/#splitted-routers","text":"You now have the responsibility to wire the routers . FastAPI Users doesn't give a bloated users router anymore. Event handlers are also removed. You have to provide your \"after-\" logic as a parameter of the router generator.","title":"Splitted routers"},{"location":"migration/08_to_1x/#before","text":"jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . router , prefix = \"/users\" , tags = [ \"users\" ]) @fastapi_users . on_after_register () def on_after_register ( user : User , request : Request ): print ( f \"User { user . id } has registered.\" ) @fastapi_users . on_after_forgot_password () def on_after_forgot_password ( user : User , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" )","title":"Before"},{"location":"migration/08_to_1x/#after","text":"def on_after_register ( user : UserDB , request : Request ): print ( f \"User { user . id } has registered.\" ) def on_after_forgot_password ( user : UserDB , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . get_auth_router ( jwt_authentication ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( on_after_register ), prefix = \"/auth\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_reset_password_router ( SECRET , after_forgot_password = on_after_forgot_password ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) Important things to notice: FastAPIUsers takes two arguments less ( reset_password_token_secret and reset_password_token_lifetime_seconds ). You have more flexibility to choose the prefix and tags of the routers. The /login / /logout are now your responsibility to include for each backend. The path will change (before /login/jwt , after /jwt/login ). If you don't care about some of those routers, you can discard them.","title":"After"},{"location":"migration/1x_to_2x/","text":"1.x.x \u27a1\ufe0f 2.x.x \u00b6 JWT authentication backend \u00b6 To be fully compatible with Swagger authentication, the output of a successful login operation with the JWT authentication backend has changed: Before { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } After { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Make sure to update your clients to read the token in the right property.","title":"1.x.x \u27a1\ufe0f 2.x.x"},{"location":"migration/1x_to_2x/#1xx-2xx","text":"","title":"1.x.x \u27a1\ufe0f 2.x.x"},{"location":"migration/1x_to_2x/#jwt-authentication-backend","text":"To be fully compatible with Swagger authentication, the output of a successful login operation with the JWT authentication backend has changed: Before { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } After { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Make sure to update your clients to read the token in the right property.","title":"JWT authentication backend"},{"location":"migration/2x_to_3x/","text":"2.x.x \u27a1\ufe0f 3.x.x \u00b6 Emails are now case-insensitive \u00b6 Before 3.x.x, the local part (before the @) of the email address was case-sensitive. Therefore, king.arthur@camelot.bt and King.Arthur@camelot.bt were considered as two different users . This behaviour was a bit confusing and not consistent with 99% of web services out there. After 3.x.x, users are fetched from the database with a case-insensitive email search. Bear in mind though that if the user registers with the email King.Arthur@camelot.bt , it will be stored exactly like this in the database (with casing) ; but he will be able to login as king.arthur@camelot.bt . Danger It's super important then, before you upgrade to 3.x.x that you check if there are several users with the same email with different cases ; and that you merge or delete those accounts .","title":"2.x.x \u27a1\ufe0f 3.x.x"},{"location":"migration/2x_to_3x/#2xx-3xx","text":"","title":"2.x.x \u27a1\ufe0f 3.x.x"},{"location":"migration/2x_to_3x/#emails-are-now-case-insensitive","text":"Before 3.x.x, the local part (before the @) of the email address was case-sensitive. Therefore, king.arthur@camelot.bt and King.Arthur@camelot.bt were considered as two different users . This behaviour was a bit confusing and not consistent with 99% of web services out there. After 3.x.x, users are fetched from the database with a case-insensitive email search. Bear in mind though that if the user registers with the email King.Arthur@camelot.bt , it will be stored exactly like this in the database (with casing) ; but he will be able to login as king.arthur@camelot.bt . Danger It's super important then, before you upgrade to 3.x.x that you check if there are several users with the same email with different cases ; and that you merge or delete those accounts .","title":"Emails are now case-insensitive"},{"location":"migration/3x_to_4x/","text":"3.x.x \u27a1\ufe0f 4.x.x \u00b6 expires_at property in OAuthAccount is now optional \u00b6 Before 4.x.x, the expires_at property in OAuthAccount model was mandatory. It was causing issues with some services that don't have such expiration property. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"3.x.x \u27a1\ufe0f 4.x.x"},{"location":"migration/3x_to_4x/#3xx-4xx","text":"","title":"3.x.x \u27a1\ufe0f 4.x.x"},{"location":"migration/3x_to_4x/#expires_at-property-in-oauthaccount-is-now-optional","text":"Before 4.x.x, the expires_at property in OAuthAccount model was mandatory. It was causing issues with some services that don't have such expiration property. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"expires_at property in OAuthAccount is now optional"},{"location":"migration/4x_to_5x/","text":"4.x.x \u27a1\ufe0f 5.x.x \u00b6 New property is_verified in User model. \u00b6 Starting 5.x.x., there is a new e-mail verification feature . Even if optional, the is_verified property has been added to the User model. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"4.x.x \u27a1\ufe0f 5.x.x"},{"location":"migration/4x_to_5x/#4xx-5xx","text":"","title":"4.x.x \u27a1\ufe0f 5.x.x"},{"location":"migration/4x_to_5x/#new-property-is_verified-in-user-model","text":"Starting 5.x.x., there is a new e-mail verification feature . Even if optional, the is_verified property has been added to the User model. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"New property is_verified in User model."},{"location":"migration/6x_to_7x/","text":"6.x.x \u27a1\ufe0f 7.x.x \u00b6 The deprecated dependencies to retrieve current user have been removed. Use the current_user factory instead. [ Documentation ] When trying to authenticate a not verified user, a status code 403 is raised instead of status code 401. Thanks @daanbeverdam \ud83c\udf89 [ Documentation ] Your UserUpdate model shouldn't inherit from the base User class. If you have custom fields, you should repeat them in this model. [ Documentation ] Database adapters now live in their own repositories and packages . When upgrading to v7.0.0, the dependency for your database adapter should automatically be installed. The import statements remain unchanged.","title":"6.x.x \u27a1\ufe0f 7.x.x"},{"location":"migration/6x_to_7x/#6xx-7xx","text":"The deprecated dependencies to retrieve current user have been removed. Use the current_user factory instead. [ Documentation ] When trying to authenticate a not verified user, a status code 403 is raised instead of status code 401. Thanks @daanbeverdam \ud83c\udf89 [ Documentation ] Your UserUpdate model shouldn't inherit from the base User class. If you have custom fields, you should repeat them in this model. [ Documentation ] Database adapters now live in their own repositories and packages . When upgrading to v7.0.0, the dependency for your database adapter should automatically be installed. The import statements remain unchanged.","title":"6.x.x \u27a1\ufe0f 7.x.x"},{"location":"migration/7x_to_8x/","text":"7.x.x \u27a1\ufe0f 8.x.x \u00b6 Version 8 includes the biggest code changes since version 1. We reorganized lot of parts of the code to make it even more modular and integrate more into the dependency injection system of FastAPI. Most importantly, you need now to implement a UserManager class and a associated dependency to create an instance of this class. Event handlers should live in the UserManager \u00b6 Before, event handlers like on_after_register or on_after_forgot_password were defined in their own functions that were passed as arguments of router generators. Now, they should be methods of the UserManager class. You can read more in the UserManager documentation . Password validation should live in the UserManager \u00b6 Before, password validation was defined in its own function that was passed as argument of FastAPIUsers . Now, it should be a method of the UserManager class. You can read more in the UserManager documentation . Verify token secret and lifetime parameters are attributes of UserManager \u00b6 Before, verify token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation . Reset password token secret and lifetime parameters are attributes of UserManager \u00b6 Before, reset password token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation . Database adapter should be provided in a dependency \u00b6 Before, we advised to directly instantiate the database adapter class. Now, it should be instantiated inside a dependency that you define yourself. The benefit of this is that it lives in the dependency injection system of FastAPI, allowing you to have more dynamic logic to create your instance. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using MongoDB \u27a1\ufe0f I'm using Tortoise ORM \u27a1\ufe0f I'm using ormar FastAPIUsers now expect a get_user_manager dependency \u00b6 Before, the database adapter instance was passed as argument of FastAPIUsers . Now, you should define a get_user_manager dependency returning an instance of your UserManager class. This dependency will be dependent of the database adapter dependency. You can read more in the UserManager documentation and FastAPIUsers documentation Lost? \u00b6 If you're unsure or a bit lost, make sure to check the full working examples .","title":"7.x.x \u27a1\ufe0f 8.x.x"},{"location":"migration/7x_to_8x/#7xx-8xx","text":"Version 8 includes the biggest code changes since version 1. We reorganized lot of parts of the code to make it even more modular and integrate more into the dependency injection system of FastAPI. Most importantly, you need now to implement a UserManager class and a associated dependency to create an instance of this class.","title":"7.x.x \u27a1\ufe0f 8.x.x"},{"location":"migration/7x_to_8x/#event-handlers-should-live-in-the-usermanager","text":"Before, event handlers like on_after_register or on_after_forgot_password were defined in their own functions that were passed as arguments of router generators. Now, they should be methods of the UserManager class. You can read more in the UserManager documentation .","title":"Event handlers should live in the UserManager"},{"location":"migration/7x_to_8x/#password-validation-should-live-in-the-usermanager","text":"Before, password validation was defined in its own function that was passed as argument of FastAPIUsers . Now, it should be a method of the UserManager class. You can read more in the UserManager documentation .","title":"Password validation should live in the UserManager"},{"location":"migration/7x_to_8x/#verify-token-secret-and-lifetime-parameters-are-attributes-of-usermanager","text":"Before, verify token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation .","title":"Verify token secret and lifetime parameters are attributes of UserManager"},{"location":"migration/7x_to_8x/#reset-password-token-secret-and-lifetime-parameters-are-attributes-of-usermanager","text":"Before, reset password token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation .","title":"Reset password token secret and lifetime parameters are attributes of UserManager"},{"location":"migration/7x_to_8x/#database-adapter-should-be-provided-in-a-dependency","text":"Before, we advised to directly instantiate the database adapter class. Now, it should be instantiated inside a dependency that you define yourself. The benefit of this is that it lives in the dependency injection system of FastAPI, allowing you to have more dynamic logic to create your instance. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using MongoDB \u27a1\ufe0f I'm using Tortoise ORM \u27a1\ufe0f I'm using ormar","title":"Database adapter should be provided in a dependency"},{"location":"migration/7x_to_8x/#fastapiusers-now-expect-a-get_user_manager-dependency","text":"Before, the database adapter instance was passed as argument of FastAPIUsers . Now, you should define a get_user_manager dependency returning an instance of your UserManager class. This dependency will be dependent of the database adapter dependency. You can read more in the UserManager documentation and FastAPIUsers documentation","title":"FastAPIUsers now expect a get_user_manager dependency"},{"location":"migration/7x_to_8x/#lost","text":"If you're unsure or a bit lost, make sure to check the full working examples .","title":"Lost?"},{"location":"migration/8x_to_9x/","text":"8.x.x \u27a1\ufe0f 9.x.x \u00b6 Version 9 revamps the authentication backends: we splitted the logic of a backend into two: the transport , which is how the token will be carried over the request and the strategy , which is how the token is generated and secured. The benefit of this is that we'll soon be able to propose new strategies, like database session tokens, without having to repeat the transport logic which remains the same. Convert the authentication backend \u00b6 You now have to generate an authentication backend with a transport and a strategy. I used JWTAuthentication \u00b6 Before After from fastapi_users.authentication import JWTAuthentication jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 , tokenUrl = \"auth/jwt/login\" ) from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends. I used CookieAuthentication \u00b6 Before After from fastapi_users.authentication import CookieAuthentication cookie_authentication = CookieAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) from fastapi_users.authentication import AuthenticationBackend , CookieTransport , JWTStrategy SECRET = \"SECRET\" cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"cookie\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends. Tip Notice that the strategy is the same for both authentication backends. That's the beauty of this approach: the token generation is decoupled from its transport. OAuth: one router for each backend \u00b6 Before, a single OAuth router was enough to login with any of your authentication backend. Now, you need to generate a router for each of your backends. Before After app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) authentication_backend is not needed on /authorize \u00b6 The consequence of this is that you don't need to specify the authentication backend when making a request to /authorize . Before After curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize?authentication_backend = jwt curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize Lost? \u00b6 If you're unsure or a bit lost, make sure to check the full working examples .","title":"8.x.x \u27a1\ufe0f 9.x.x"},{"location":"migration/8x_to_9x/#8xx-9xx","text":"Version 9 revamps the authentication backends: we splitted the logic of a backend into two: the transport , which is how the token will be carried over the request and the strategy , which is how the token is generated and secured. The benefit of this is that we'll soon be able to propose new strategies, like database session tokens, without having to repeat the transport logic which remains the same.","title":"8.x.x \u27a1\ufe0f 9.x.x"},{"location":"migration/8x_to_9x/#convert-the-authentication-backend","text":"You now have to generate an authentication backend with a transport and a strategy.","title":"Convert the authentication backend"},{"location":"migration/8x_to_9x/#i-used-jwtauthentication","text":"Before After from fastapi_users.authentication import JWTAuthentication jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 , tokenUrl = \"auth/jwt/login\" ) from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends.","title":"I used JWTAuthentication"},{"location":"migration/8x_to_9x/#i-used-cookieauthentication","text":"Before After from fastapi_users.authentication import CookieAuthentication cookie_authentication = CookieAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) from fastapi_users.authentication import AuthenticationBackend , CookieTransport , JWTStrategy SECRET = \"SECRET\" cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"cookie\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends. Tip Notice that the strategy is the same for both authentication backends. That's the beauty of this approach: the token generation is decoupled from its transport.","title":"I used CookieAuthentication"},{"location":"migration/8x_to_9x/#oauth-one-router-for-each-backend","text":"Before, a single OAuth router was enough to login with any of your authentication backend. Now, you need to generate a router for each of your backends. Before After app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], )","title":"OAuth: one router for each backend"},{"location":"migration/8x_to_9x/#authentication_backend-is-not-needed-on-authorize","text":"The consequence of this is that you don't need to specify the authentication backend when making a request to /authorize . Before After curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize?authentication_backend = jwt curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize","title":"authentication_backend is not needed on /authorize"},{"location":"migration/8x_to_9x/#lost","text":"If you're unsure or a bit lost, make sure to check the full working examples .","title":"Lost?"},{"location":"migration/9x_to_10x/","text":"9.x.x \u27a1\ufe0f 10.x.x \u00b6 Version 10 marks important changes in how we manage User models and their ID. Before, we were relying only on Pydantic models to work with users. In particular the current_user dependency would return you an instance of UserDB , a Pydantic model. This proved to be quite problematic with some ORM if you ever needed to retrieve relationship data or make specific requests. Now, FastAPI Users is designed to always return you a native object for your ORM model , whether it's an SQLAlchemy model or a Beanie document. Pydantic models are now only used for validation and serialization inside the API. Before, we were forcing the use of UUID as primary key ID; a consequence of the design above. This proved to be quite problematic on some databases, like MongoDB which uses a special ObjectID format by default. Some SQL folks also prefer to use traditional auto-increment integers. Now, FastAPI Users is designed to use generic ID type . It means that you can use any type you want for your user's ID. By default, SQLAlchemy adapter still use UUID; but you can quite easily switch to another thing, like an integer. Beanie adapter for MongoDB will use native ObjectID by default, but it also can be overriden. As you may have guessed, those changes imply quite a lot of breaking changes . User models and database adapter \u00b6 SQLAlchemy ORM \u00b6 We've removed the old SQLAlchemy dependency support, so the dependency is now fastapi-users[sqlalchemy] . Before After fastapi fastapi-users[sqlalchemy2] uvicorn[standard] aiosqlite fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite The User model base class for SQLAlchemy slightly changed to support UUID by default. We changed the name of the class from UserTable to User : it's not a compulsory change, but since there is no risk of confusion with Pydantic models anymore, it's probably a more idiomatic naming. Before After class UserTable ( Base , SQLAlchemyBaseUserTable ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): pass Instantiating the SQLAlchemyUserDatabase adapter now only expects this User model. UserDB is removed. Before After async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( UserDB , session , UserTable ) async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) MongoDB \u00b6 MongoDB support is now only provided through Beanie ODM . Even if you don't use it for the rest of your project, it's a very light addition that shouldn't interfere much. Before After fastapi fastapi-users[mongodb] uvicorn[standard] aiosqlite fastapi fastapi-users[beanie] uvicorn[standard] aiosqlite You now need to define a proper User model using Beanie. Before After import os import motor.motor_asyncio from fastapi_users.db import MongoDBUserDatabase from app.models import UserDB DATABASE_URL = os . environ [ \"DATABASE_URL\" ] client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] collection = db [ \"users\" ] async def get_user_db (): yield MongoDBUserDatabase ( UserDB , collection ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) ID are now ObjectID by default By default, User ID will now be native MongoDB ObjectID. If you don't want to make the transition and keep UUID you can do so by overriding the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Beanie also needs to be initialized in a startup event handler of your FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) Tortoise ORM and ormar \u00b6 Unfortunately, we sometimes need to make difficult choices to keep things sustainable. That's why we decided to not support Tortoise ORM and ormar anymore. It appeared they were not widely used. You can still add support for those ORM yourself by implementing the necessary adapter. You can take inspiration from the SQLAlchemy one . UserManager \u00b6 There is some slight changes on the UserManager class. In particular, it now needs a parse_id method that can be provided through built-in mixins. Generic typing now expects your native User model class and the type of ID . The user_db_model class property is removed . Before After class UserManager ( BaseUserManager [ UserCreate , UserDB ]): user_db_model = UserDB reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : UserDB , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) If you need to support other types of ID, you can read more about it in the dedicated section . Pydantic models \u00b6 To better distinguish them from the ORM models, Pydantic models are now called schemas . UserDB has been removed in favor of native models. We changed the name of User to UserRead : it's not a compulsory change, but since there is a risk of confusion with the native model, it's highly recommended. Besides, the BaseUser schema now accepts a generic type to specify the type of ID you use. Before After from fastapi_users import models class User ( models . BaseUser ): pass class UserCreate ( models . BaseUserCreate ): pass class UserUpdate ( models . BaseUserUpdate ): pass class UserDB ( User , models . BaseUserDB ): pass import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass FastAPI Users and routers \u00b6 Pydantic schemas are now way less important in this new design. As such, you don't need to pass them when initializing the FastAPIUsers class: Before After fastapi_users = FastAPIUsers ( get_user_manager , [ auth_backend ], User , UserCreate , UserUpdate , UserDB , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) As a consequence, those schemas need to be passed when initializing the router that needs them: get_register_router , get_verify_router and get_users_router . Before After app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router (), prefix = \"/auth\" , tags = [ \"auth\" ]) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) Lost? \u00b6 If you're unsure or a bit lost, make sure to check the full working examples .","title":"9.x.x \u27a1\ufe0f 10.x.x"},{"location":"migration/9x_to_10x/#9xx-10xx","text":"Version 10 marks important changes in how we manage User models and their ID. Before, we were relying only on Pydantic models to work with users. In particular the current_user dependency would return you an instance of UserDB , a Pydantic model. This proved to be quite problematic with some ORM if you ever needed to retrieve relationship data or make specific requests. Now, FastAPI Users is designed to always return you a native object for your ORM model , whether it's an SQLAlchemy model or a Beanie document. Pydantic models are now only used for validation and serialization inside the API. Before, we were forcing the use of UUID as primary key ID; a consequence of the design above. This proved to be quite problematic on some databases, like MongoDB which uses a special ObjectID format by default. Some SQL folks also prefer to use traditional auto-increment integers. Now, FastAPI Users is designed to use generic ID type . It means that you can use any type you want for your user's ID. By default, SQLAlchemy adapter still use UUID; but you can quite easily switch to another thing, like an integer. Beanie adapter for MongoDB will use native ObjectID by default, but it also can be overriden. As you may have guessed, those changes imply quite a lot of breaking changes .","title":"9.x.x \u27a1\ufe0f 10.x.x"},{"location":"migration/9x_to_10x/#user-models-and-database-adapter","text":"","title":"User models and database adapter"},{"location":"migration/9x_to_10x/#sqlalchemy-orm","text":"We've removed the old SQLAlchemy dependency support, so the dependency is now fastapi-users[sqlalchemy] . Before After fastapi fastapi-users[sqlalchemy2] uvicorn[standard] aiosqlite fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite The User model base class for SQLAlchemy slightly changed to support UUID by default. We changed the name of the class from UserTable to User : it's not a compulsory change, but since there is no risk of confusion with Pydantic models anymore, it's probably a more idiomatic naming. Before After class UserTable ( Base , SQLAlchemyBaseUserTable ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): pass Instantiating the SQLAlchemyUserDatabase adapter now only expects this User model. UserDB is removed. Before After async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( UserDB , session , UserTable ) async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User )","title":"SQLAlchemy ORM"},{"location":"migration/9x_to_10x/#mongodb","text":"MongoDB support is now only provided through Beanie ODM . Even if you don't use it for the rest of your project, it's a very light addition that shouldn't interfere much. Before After fastapi fastapi-users[mongodb] uvicorn[standard] aiosqlite fastapi fastapi-users[beanie] uvicorn[standard] aiosqlite You now need to define a proper User model using Beanie. Before After import os import motor.motor_asyncio from fastapi_users.db import MongoDBUserDatabase from app.models import UserDB DATABASE_URL = os . environ [ \"DATABASE_URL\" ] client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] collection = db [ \"users\" ] async def get_user_db (): yield MongoDBUserDatabase ( UserDB , collection ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) ID are now ObjectID by default By default, User ID will now be native MongoDB ObjectID. If you don't want to make the transition and keep UUID you can do so by overriding the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Beanie also needs to be initialized in a startup event handler of your FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], )","title":"MongoDB"},{"location":"migration/9x_to_10x/#tortoise-orm-and-ormar","text":"Unfortunately, we sometimes need to make difficult choices to keep things sustainable. That's why we decided to not support Tortoise ORM and ormar anymore. It appeared they were not widely used. You can still add support for those ORM yourself by implementing the necessary adapter. You can take inspiration from the SQLAlchemy one .","title":"Tortoise ORM and ormar"},{"location":"migration/9x_to_10x/#usermanager","text":"There is some slight changes on the UserManager class. In particular, it now needs a parse_id method that can be provided through built-in mixins. Generic typing now expects your native User model class and the type of ID . The user_db_model class property is removed . Before After class UserManager ( BaseUserManager [ UserCreate , UserDB ]): user_db_model = UserDB reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : UserDB , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) If you need to support other types of ID, you can read more about it in the dedicated section .","title":"UserManager"},{"location":"migration/9x_to_10x/#pydantic-models","text":"To better distinguish them from the ORM models, Pydantic models are now called schemas . UserDB has been removed in favor of native models. We changed the name of User to UserRead : it's not a compulsory change, but since there is a risk of confusion with the native model, it's highly recommended. Besides, the BaseUser schema now accepts a generic type to specify the type of ID you use. Before After from fastapi_users import models class User ( models . BaseUser ): pass class UserCreate ( models . BaseUserCreate ): pass class UserUpdate ( models . BaseUserUpdate ): pass class UserDB ( User , models . BaseUserDB ): pass import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass","title":"Pydantic models"},{"location":"migration/9x_to_10x/#fastapi-users-and-routers","text":"Pydantic schemas are now way less important in this new design. As such, you don't need to pass them when initializing the FastAPIUsers class: Before After fastapi_users = FastAPIUsers ( get_user_manager , [ auth_backend ], User , UserCreate , UserUpdate , UserDB , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) As a consequence, those schemas need to be passed when initializing the router that needs them: get_register_router , get_verify_router and get_users_router . Before After app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router (), prefix = \"/auth\" , tags = [ \"auth\" ]) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"FastAPI Users and routers"},{"location":"migration/9x_to_10x/#lost","text":"If you're unsure or a bit lost, make sure to check the full working examples .","title":"Lost?"},{"location":"usage/current-user/","text":"Get current user \u00b6 FastAPI Users provides a dependency callable to easily inject authenticated user in your routes. They are available from your FastAPIUsers instance. Tip For more information about how to make an authenticated request to your API, check the documentation of your Authentication method . current_user \u00b6 Return a dependency callable to retrieve currently authenticated user, passing the following parameters: optional : If True , None is returned if there is no authenticated user or if it doesn't pass the other requirements. Otherwise, throw 401 Unauthorized . Defaults to False . active : If True , throw 401 Unauthorized if the authenticated user is inactive. Defaults to False . verified : If True , throw 403 Forbidden if the authenticated user is not verified. Defaults to False . superuser : If True , throw 403 Forbidden if the authenticated user is not a superuser. Defaults to False . get_enabled_backends : Optional dependency callable returning a list of enabled authentication backends. Useful if you want to dynamically enable some authentication backends based on external logic, like a configuration in database. By default, all specified authentication backends are enabled. Please not however that every backends will appear in the OpenAPI documentation, as FastAPI resolves it statically. Create it once and reuse it This function is a factory , a function returning another function \ud83e\udd2f It's this returned function that will be the dependency called by FastAPI in your API routes. To avoid having to generate it on each route and avoid issues when unit testing, it's strongly recommended that you assign the result in a variable and reuse it at will in your routes. The examples below demonstrate this pattern. Examples \u00b6 Get the current user ( active or not ) \u00b6 current_user = fastapi_users . current_user () @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_user )): return f \"Hello, { user . email } \" Get the current active user \u00b6 current_active_user = fastapi_users . current_user ( active = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } \" Get the current active and verified user \u00b6 current_active_verified_user = fastapi_users . current_user ( active = True , verified = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_verified_user )): return f \"Hello, { user . email } \" Get the current active superuser \u00b6 current_superuser = fastapi_users . current_user ( active = True , superuser = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_superuser )): return f \"Hello, { user . email } \" Dynamically enable authentication backends \u00b6 Warning This is an advanced feature for cases where you have several authentication backends that are enabled conditionally. In most cases, you won't need this option. from fastapi import Request from fastapi_users.authentication import AuthenticationBackend , BearerTransport , CookieTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) jwt_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) cookie_backend = AuthenticationBackend ( name = \"jwt\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) async def get_enabled_backends ( request : Request ): \"\"\"Return the enabled dependencies following custom logic.\"\"\" if request . url . path == \"/protected-route-only-jwt\" : return [ jwt_backend ] else : return [ cookie_backend , jwt_backend ] current_active_user = fastapi_users . current_user ( active = True , get_enabled_backends = get_enabled_backends ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a cookie or a JWT.\" @app . get ( \"/protected-route-only-jwt\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a JWT.\" In a path operation \u00b6 If you don't need the user in the route logic, you can use this syntax: @app . get ( \"/protected-route\" , dependencies = [ Depends ( current_superuser )]) def protected_route (): return \"Hello, some user.\" You can read more about this in FastAPI docs .","title":"Get current user"},{"location":"usage/current-user/#get-current-user","text":"FastAPI Users provides a dependency callable to easily inject authenticated user in your routes. They are available from your FastAPIUsers instance. Tip For more information about how to make an authenticated request to your API, check the documentation of your Authentication method .","title":"Get current user"},{"location":"usage/current-user/#current_user","text":"Return a dependency callable to retrieve currently authenticated user, passing the following parameters: optional : If True , None is returned if there is no authenticated user or if it doesn't pass the other requirements. Otherwise, throw 401 Unauthorized . Defaults to False . active : If True , throw 401 Unauthorized if the authenticated user is inactive. Defaults to False . verified : If True , throw 403 Forbidden if the authenticated user is not verified. Defaults to False . superuser : If True , throw 403 Forbidden if the authenticated user is not a superuser. Defaults to False . get_enabled_backends : Optional dependency callable returning a list of enabled authentication backends. Useful if you want to dynamically enable some authentication backends based on external logic, like a configuration in database. By default, all specified authentication backends are enabled. Please not however that every backends will appear in the OpenAPI documentation, as FastAPI resolves it statically. Create it once and reuse it This function is a factory , a function returning another function \ud83e\udd2f It's this returned function that will be the dependency called by FastAPI in your API routes. To avoid having to generate it on each route and avoid issues when unit testing, it's strongly recommended that you assign the result in a variable and reuse it at will in your routes. The examples below demonstrate this pattern.","title":"current_user"},{"location":"usage/current-user/#examples","text":"","title":"Examples"},{"location":"usage/current-user/#get-the-current-user-active-or-not","text":"current_user = fastapi_users . current_user () @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_user )): return f \"Hello, { user . email } \"","title":"Get the current user (active or not)"},{"location":"usage/current-user/#get-the-current-active-user","text":"current_active_user = fastapi_users . current_user ( active = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } \"","title":"Get the current active user"},{"location":"usage/current-user/#get-the-current-active-and-verified-user","text":"current_active_verified_user = fastapi_users . current_user ( active = True , verified = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_verified_user )): return f \"Hello, { user . email } \"","title":"Get the current active and verified user"},{"location":"usage/current-user/#get-the-current-active-superuser","text":"current_superuser = fastapi_users . current_user ( active = True , superuser = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_superuser )): return f \"Hello, { user . email } \"","title":"Get the current active superuser"},{"location":"usage/current-user/#dynamically-enable-authentication-backends","text":"Warning This is an advanced feature for cases where you have several authentication backends that are enabled conditionally. In most cases, you won't need this option. from fastapi import Request from fastapi_users.authentication import AuthenticationBackend , BearerTransport , CookieTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) jwt_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) cookie_backend = AuthenticationBackend ( name = \"jwt\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) async def get_enabled_backends ( request : Request ): \"\"\"Return the enabled dependencies following custom logic.\"\"\" if request . url . path == \"/protected-route-only-jwt\" : return [ jwt_backend ] else : return [ cookie_backend , jwt_backend ] current_active_user = fastapi_users . current_user ( active = True , get_enabled_backends = get_enabled_backends ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a cookie or a JWT.\" @app . get ( \"/protected-route-only-jwt\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a JWT.\"","title":"Dynamically enable authentication backends"},{"location":"usage/current-user/#in-a-path-operation","text":"If you don't need the user in the route logic, you can use this syntax: @app . get ( \"/protected-route\" , dependencies = [ Depends ( current_superuser )]) def protected_route (): return \"Hello, some user.\" You can read more about this in FastAPI docs .","title":"In a path operation"},{"location":"usage/flow/","text":"Flow \u00b6 This page will present you a complete registration and authentication flow once you've setup FastAPI Users . Each example will be presented with a cURL and an axios example. 1. Registration \u00b6 First step, of course, is to register as a user. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -X POST \\ -d \"{\\\"email\\\": \\\"king.arthur@camelot.bt\\\",\\\"password\\\": \\\"guinevere\\\"}\" \\ http://localhost:8000/auth/register axios . post ( 'http://localhost:8000/auth/register' , { email : 'king.arthur@camelot.bt' , password : 'guinevere' , }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Several things to bear in mind: If you have defined other required fields in your User model (like a first name or a birthdate), you'll have to provide them in the payload. The user is active by default. The user cannot set is_active or is_superuser itself at registration. Only a superuser can do it by PATCHing the user. 2. Login \u00b6 Now, you can login as this new user. You can generate a login route for each authentication backend . Each backend will have a different response. Bearer + JWT \u00b6 Request \u00b6 cURL axios curl \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/jwt/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/jwt/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username . Response \u00b6 You'll get a JSON response looking like this: { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" , \"token_type\" : \"bearer\" } You can use this token to make authenticated requests as the user king.arthur@camelot.bt . We'll see how in the next section. Cookie + JWT \u00b6 Request \u00b6 cURL axios curl \\ -v \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/cookie/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/cookie/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username . Response \u00b6 You'll get an empty response. However, the response will come with a Set-Cookie header (that's why we added the -v option in cURL to see them). set-cookie: fastapiusersauth=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYzYwNjBmMTEtNTM0OS00YTI0LThiNGEtYTJhODc1ZGM1Mzk1IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4OTQ3fQ.qNA4oPVYhoqrJIk-zvAyEfEVoEnP156G30H_SWEU0sU; HttpOnly; Max-Age=3600; Path=/; Secure You can make authenticated requests as the user king.arthur@camelot.bt by setting a Cookie header with this cookie. Tip The cookie backend is more suited for browsers, as they handle them automatically. This means that if you make a login request in the browser, it will automatically store the cookie and automatically send it in subsequent requests. 3. Get my profile \u00b6 Now that we can authenticate, we can get our own profile data. Depending on your authentication backend , the method to authenticate the request will vary. We'll stick with JWT from now on. Request \u00b6 cURL axios export TOKEN = \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" ; curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/me const TOKEN = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM' ; axios . get ( 'http://localhost:8000/users/me' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Tip If you use one of the dependency callable to protect one of your own endpoint, you'll have to authenticate exactly in the same way. 4. Update my profile \u00b6 We can also update our own profile. For example, we can change our password like this. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"password\\\": \\\"lancelot\\\"}\" \\ http://localhost:8000/users/me axios . patch ( 'http://localhost:8000/users/me' , { password : 'lancelot' , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Once again, the user cannot set is_active or is_superuser itself. Only a superuser can do it by PATCHing the user. 5. Become a superuser \ud83e\uddb8\ud83c\udffb\u200d\u2642\ufe0f \u00b6 If you want to manage the users of your application, you'll have to become a superuser . The very first superuser can only be set at database level : open it through a CLI or a GUI, find your user and set the is_superuser column/property to true . 5.1. Get the profile of any user \u00b6 Now that you are a superuser, you can leverage the power of superuser routes . You can for example get the profile of any user in the database given its id. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . get ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 5.1. Update any user \u00b6 We can now update the profile of any user. For example, we can promote it as superuser. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"is_superuser\\\": true}\" \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . patch ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { is_superuser : true , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : true } 5.2. Delete any user \u00b6 Finally, we can delete a user. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X DELETE \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . delete ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get an empty response. 6. Logout \u00b6 We can also end the session. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Cookie: fastapiusersauth= $TOKEN \" \\ -X POST \\ http://localhost:8000/auth/cookie/logout axios . post ( 'http://localhost:8000/auth/cookie/logout' , null , { headers : { 'Cookie' : `fastapiusersauth= ${ TOKEN } ` , }, } ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get an empty response. Conclusion \u00b6 That's it! You now have a good overview of how you can manage the users through the API. Be sure to check the Routes page to have all the details about each endpoints.","title":"Flow"},{"location":"usage/flow/#flow","text":"This page will present you a complete registration and authentication flow once you've setup FastAPI Users . Each example will be presented with a cURL and an axios example.","title":"Flow"},{"location":"usage/flow/#1-registration","text":"First step, of course, is to register as a user.","title":"1. Registration"},{"location":"usage/flow/#request","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -X POST \\ -d \"{\\\"email\\\": \\\"king.arthur@camelot.bt\\\",\\\"password\\\": \\\"guinevere\\\"}\" \\ http://localhost:8000/auth/register axios . post ( 'http://localhost:8000/auth/register' , { email : 'king.arthur@camelot.bt' , password : 'guinevere' , }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Several things to bear in mind: If you have defined other required fields in your User model (like a first name or a birthdate), you'll have to provide them in the payload. The user is active by default. The user cannot set is_active or is_superuser itself at registration. Only a superuser can do it by PATCHing the user.","title":"Response"},{"location":"usage/flow/#2-login","text":"Now, you can login as this new user. You can generate a login route for each authentication backend . Each backend will have a different response.","title":"2. Login"},{"location":"usage/flow/#bearer-jwt","text":"","title":"Bearer + JWT"},{"location":"usage/flow/#request_1","text":"cURL axios curl \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/jwt/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/jwt/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username .","title":"Request"},{"location":"usage/flow/#response_1","text":"You'll get a JSON response looking like this: { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" , \"token_type\" : \"bearer\" } You can use this token to make authenticated requests as the user king.arthur@camelot.bt . We'll see how in the next section.","title":"Response"},{"location":"usage/flow/#cookie-jwt","text":"","title":"Cookie + JWT"},{"location":"usage/flow/#request_2","text":"cURL axios curl \\ -v \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/cookie/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/cookie/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username .","title":"Request"},{"location":"usage/flow/#response_2","text":"You'll get an empty response. However, the response will come with a Set-Cookie header (that's why we added the -v option in cURL to see them). set-cookie: fastapiusersauth=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYzYwNjBmMTEtNTM0OS00YTI0LThiNGEtYTJhODc1ZGM1Mzk1IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4OTQ3fQ.qNA4oPVYhoqrJIk-zvAyEfEVoEnP156G30H_SWEU0sU; HttpOnly; Max-Age=3600; Path=/; Secure You can make authenticated requests as the user king.arthur@camelot.bt by setting a Cookie header with this cookie. Tip The cookie backend is more suited for browsers, as they handle them automatically. This means that if you make a login request in the browser, it will automatically store the cookie and automatically send it in subsequent requests.","title":"Response"},{"location":"usage/flow/#3-get-my-profile","text":"Now that we can authenticate, we can get our own profile data. Depending on your authentication backend , the method to authenticate the request will vary. We'll stick with JWT from now on.","title":"3. Get my profile"},{"location":"usage/flow/#request_3","text":"cURL axios export TOKEN = \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" ; curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/me const TOKEN = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM' ; axios . get ( 'http://localhost:8000/users/me' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_3","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Tip If you use one of the dependency callable to protect one of your own endpoint, you'll have to authenticate exactly in the same way.","title":"Response"},{"location":"usage/flow/#4-update-my-profile","text":"We can also update our own profile. For example, we can change our password like this.","title":"4. Update my profile"},{"location":"usage/flow/#request_4","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"password\\\": \\\"lancelot\\\"}\" \\ http://localhost:8000/users/me axios . patch ( 'http://localhost:8000/users/me' , { password : 'lancelot' , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_4","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Once again, the user cannot set is_active or is_superuser itself. Only a superuser can do it by PATCHing the user.","title":"Response"},{"location":"usage/flow/#5-become-a-superuser","text":"If you want to manage the users of your application, you'll have to become a superuser . The very first superuser can only be set at database level : open it through a CLI or a GUI, find your user and set the is_superuser column/property to true .","title":"5. Become a superuser \ud83e\uddb8\ud83c\udffb\u200d\u2642\ufe0f"},{"location":"usage/flow/#51-get-the-profile-of-any-user","text":"Now that you are a superuser, you can leverage the power of superuser routes . You can for example get the profile of any user in the database given its id.","title":"5.1. Get the profile of any user"},{"location":"usage/flow/#request_5","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . get ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_5","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false }","title":"Response"},{"location":"usage/flow/#51-update-any-user","text":"We can now update the profile of any user. For example, we can promote it as superuser.","title":"5.1. Update any user"},{"location":"usage/flow/#request_6","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"is_superuser\\\": true}\" \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . patch ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { is_superuser : true , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_6","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : true }","title":"Response"},{"location":"usage/flow/#52-delete-any-user","text":"Finally, we can delete a user.","title":"5.2. Delete any user"},{"location":"usage/flow/#request_7","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X DELETE \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . delete ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_7","text":"You'll get an empty response.","title":"Response"},{"location":"usage/flow/#6-logout","text":"We can also end the session.","title":"6. Logout"},{"location":"usage/flow/#request_8","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Cookie: fastapiusersauth= $TOKEN \" \\ -X POST \\ http://localhost:8000/auth/cookie/logout axios . post ( 'http://localhost:8000/auth/cookie/logout' , null , { headers : { 'Cookie' : `fastapiusersauth= ${ TOKEN } ` , }, } ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_8","text":"You'll get an empty response.","title":"Response"},{"location":"usage/flow/#conclusion","text":"That's it! You now have a good overview of how you can manage the users through the API. Be sure to check the Routes page to have all the details about each endpoints.","title":"Conclusion"},{"location":"usage/routes/","text":"Routes \u00b6 You'll find here the routes exposed by FastAPI Users . Note that you can also review them through the interactive API docs . Auth router \u00b6 Each authentication backend you generate a router for will produce the following routes. Take care about the prefix you gave it, especially if you have several backends. POST /login \u00b6 Login a user against the method named name . Check the corresponding authentication method to view the success response. Payload ( application/x-www-form-urlencoded ) username=king.arthur@camelot.bt&password=guinevere 422 Validation Error 400 Bad Request Bad credentials or the user is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" } 400 Bad Request The user is not verified. { \"detail\" : \"LOGIN_USER_NOT_VERIFIED\" } POST /logout \u00b6 Logout the authenticated user against the method named name . Check the corresponding authentication method to view the success response. 401 Unauthorized Missing token or inactive user. 200 OK The logout process was successful. Register router \u00b6 POST /register \u00b6 Register a new user. Will call the on_after_register handler on successful registration. Payload { \"email\" : \"king.arthur@camelot.bt\" , \"password\" : \"guinevere\" } 201 Created { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 422 Validation Error 400 Bad Request A user already exists with this email. { \"detail\" : \"REGISTER_USER_ALREADY_EXISTS\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"REGISTER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } Reset password router \u00b6 POST /forgot-password \u00b6 Request a reset password procedure. Will generate a temporary token and call the on_after_forgot_password handler if the user exists. To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted POST /reset-password \u00b6 Reset a password. Requires the token generated by the /forgot-password route. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"password\" : \"merlin\" } 200 OK 422 Validation Error 400 Bad Request Bad or expired token. { \"detail\" : \"RESET_PASSWORD_BAD_TOKEN\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"REGISTER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } Verify router \u00b6 POST /request-verify-token \u00b6 Request a user to verify their e-mail. Will generate a temporary token and call the on_after_request_verify handler if the user exists , active and not already verified . To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist, not active or already verified. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted POST /verify \u00b6 Verify a user. Requires the token generated by the /request-verify-token route. Will call the call the on_after_verify handler on success. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } 200 OK 422 Validation Error 400 Bad Request Bad token, not existing user or not the e-mail currently set for the user. { \"detail\" : \"VERIFY_USER_BAD_TOKEN\" } 400 Bad Request The user is already verified. { \"detail\" : \"VERIFY_USER_ALREADY_VERIFIED\" } OAuth router \u00b6 Each OAuth router you define will expose the two following routes. GET /authorize \u00b6 Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" } GET /callback \u00b6 Handle the OAuth callback. Query parameters code : OAuth callback code. state : State token. error : OAuth error. Depending on the situation, several things can happen: The OAuth account exists in database and is linked to a user: OAuth account is updated in database with fresh access token. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database but a user with the same email address exists: By default, an HTTP 400 error is raised. If the associate_by_email flag is set to True on the router declaration, OAuth account is linked to the user. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database and no user with the email address exists: A new user is created and linked to the OAuth account. The user is authenticated following the chosen authentication method . 400 Bad Request Invalid token. 400 Bad Request Another user with the same e-mail address already exists. { \"detail\" : \"OAUTH_USER_ALREADY_EXISTS\" } 400 Bad Request User is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" } OAuth association router \u00b6 Each OAuth association router you define will expose the two following routes. GET /authorize \u00b6 Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 401 Unauthorized Missing token or inactive user. 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" } GET /callback \u00b6 Handle the OAuth callback and add the OAuth account to the current authenticated active user. Query parameters code : OAuth callback code. state : State token. error : OAuth error. 401 Unauthorized Missing token or inactive user. 400 Bad Request Invalid token. 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false , \"oauth_accounts\" : [ { \"id\" : \"6c98caf5-9bc5-4c4f-8a45-a0ae0c40cd77\" , \"oauth_name\" : \"TINTAGEL\" , \"access_token\" : \"ACCESS_TOKEN\" , \"expires_at\" : \"1641040620\" , \"account_id\" : \"king_arthur_tintagel\" , \"account_email\" : \"king.arthur@tintagel.bt\" } ] } Users router \u00b6 GET /me \u00b6 Return the current authenticated active user. 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. PATCH /me \u00b6 Update the current authenticated active user. Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" } 422 Validation Error GET /{user_id} \u00b6 Return the user with id user_id . 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist. PATCH /{user_id} \u00b6 Update the user with id user_id . Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" , \"is_active\" : false , \"is_superuser\" : true } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : false , \"is_superuser\" : true } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" } DELETE /{user_id} \u00b6 Delete the user with id user_id . 204 No content 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist.","title":"Routes"},{"location":"usage/routes/#routes","text":"You'll find here the routes exposed by FastAPI Users . Note that you can also review them through the interactive API docs .","title":"Routes"},{"location":"usage/routes/#auth-router","text":"Each authentication backend you generate a router for will produce the following routes. Take care about the prefix you gave it, especially if you have several backends.","title":"Auth router"},{"location":"usage/routes/#post-login","text":"Login a user against the method named name . Check the corresponding authentication method to view the success response. Payload ( application/x-www-form-urlencoded ) username=king.arthur@camelot.bt&password=guinevere 422 Validation Error 400 Bad Request Bad credentials or the user is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" } 400 Bad Request The user is not verified. { \"detail\" : \"LOGIN_USER_NOT_VERIFIED\" }","title":"POST /login"},{"location":"usage/routes/#post-logout","text":"Logout the authenticated user against the method named name . Check the corresponding authentication method to view the success response. 401 Unauthorized Missing token or inactive user. 200 OK The logout process was successful.","title":"POST /logout"},{"location":"usage/routes/#register-router","text":"","title":"Register router"},{"location":"usage/routes/#post-register","text":"Register a new user. Will call the on_after_register handler on successful registration. Payload { \"email\" : \"king.arthur@camelot.bt\" , \"password\" : \"guinevere\" } 201 Created { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 422 Validation Error 400 Bad Request A user already exists with this email. { \"detail\" : \"REGISTER_USER_ALREADY_EXISTS\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"REGISTER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } }","title":"POST /register"},{"location":"usage/routes/#reset-password-router","text":"","title":"Reset password router"},{"location":"usage/routes/#post-forgot-password","text":"Request a reset password procedure. Will generate a temporary token and call the on_after_forgot_password handler if the user exists. To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted","title":"POST /forgot-password"},{"location":"usage/routes/#post-reset-password","text":"Reset a password. Requires the token generated by the /forgot-password route. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"password\" : \"merlin\" } 200 OK 422 Validation Error 400 Bad Request Bad or expired token. { \"detail\" : \"RESET_PASSWORD_BAD_TOKEN\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"REGISTER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } }","title":"POST /reset-password"},{"location":"usage/routes/#verify-router","text":"","title":"Verify router"},{"location":"usage/routes/#post-request-verify-token","text":"Request a user to verify their e-mail. Will generate a temporary token and call the on_after_request_verify handler if the user exists , active and not already verified . To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist, not active or already verified. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted","title":"POST /request-verify-token"},{"location":"usage/routes/#post-verify","text":"Verify a user. Requires the token generated by the /request-verify-token route. Will call the call the on_after_verify handler on success. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } 200 OK 422 Validation Error 400 Bad Request Bad token, not existing user or not the e-mail currently set for the user. { \"detail\" : \"VERIFY_USER_BAD_TOKEN\" } 400 Bad Request The user is already verified. { \"detail\" : \"VERIFY_USER_ALREADY_VERIFIED\" }","title":"POST /verify"},{"location":"usage/routes/#oauth-router","text":"Each OAuth router you define will expose the two following routes.","title":"OAuth router"},{"location":"usage/routes/#get-authorize","text":"Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" }","title":"GET /authorize"},{"location":"usage/routes/#get-callback","text":"Handle the OAuth callback. Query parameters code : OAuth callback code. state : State token. error : OAuth error. Depending on the situation, several things can happen: The OAuth account exists in database and is linked to a user: OAuth account is updated in database with fresh access token. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database but a user with the same email address exists: By default, an HTTP 400 error is raised. If the associate_by_email flag is set to True on the router declaration, OAuth account is linked to the user. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database and no user with the email address exists: A new user is created and linked to the OAuth account. The user is authenticated following the chosen authentication method . 400 Bad Request Invalid token. 400 Bad Request Another user with the same e-mail address already exists. { \"detail\" : \"OAUTH_USER_ALREADY_EXISTS\" } 400 Bad Request User is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" }","title":"GET /callback"},{"location":"usage/routes/#oauth-association-router","text":"Each OAuth association router you define will expose the two following routes.","title":"OAuth association router"},{"location":"usage/routes/#get-authorize_1","text":"Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 401 Unauthorized Missing token or inactive user. 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" }","title":"GET /authorize"},{"location":"usage/routes/#get-callback_1","text":"Handle the OAuth callback and add the OAuth account to the current authenticated active user. Query parameters code : OAuth callback code. state : State token. error : OAuth error. 401 Unauthorized Missing token or inactive user. 400 Bad Request Invalid token. 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false , \"oauth_accounts\" : [ { \"id\" : \"6c98caf5-9bc5-4c4f-8a45-a0ae0c40cd77\" , \"oauth_name\" : \"TINTAGEL\" , \"access_token\" : \"ACCESS_TOKEN\" , \"expires_at\" : \"1641040620\" , \"account_id\" : \"king_arthur_tintagel\" , \"account_email\" : \"king.arthur@tintagel.bt\" } ] }","title":"GET /callback"},{"location":"usage/routes/#users-router","text":"","title":"Users router"},{"location":"usage/routes/#get-me","text":"Return the current authenticated active user. 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user.","title":"GET /me"},{"location":"usage/routes/#patch-me","text":"Update the current authenticated active user. Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" } 422 Validation Error","title":"PATCH /me"},{"location":"usage/routes/#get-user_id","text":"Return the user with id user_id . 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist.","title":"GET /{user_id}"},{"location":"usage/routes/#patch-user_id","text":"Update the user with id user_id . Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" , \"is_active\" : false , \"is_superuser\" : true } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : false , \"is_superuser\" : true } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" }","title":"PATCH /{user_id}"},{"location":"usage/routes/#delete-user_id","text":"Delete the user with id user_id . 204 No content 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist.","title":"DELETE /{user_id}"}]} \ No newline at end of file +{"config":{"indexing":"full","lang":["en"],"min_search_length":3,"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"FastAPI Users \u00b6 Ready-to-use and customizable users management for FastAPI Documentation : https://fastapi-users.github.io/fastapi-users/ Source Code : https://github.com/fastapi-users/fastapi-users Add quickly a registration and authentication system to your FastAPI project. FastAPI Users is designed to be as customizable and adaptable as possible. Features \u00b6 Extensible base user model Ready-to-use register, login, reset password and verify e-mail routes Ready-to-use social OAuth2 login flow Dependency callables to inject current user in route Pluggable password validation Customizable database backend SQLAlchemy ORM async included MongoDB with Beanie ODM included Multiple customizable authentication backends Transports: Authorization header, Cookie Strategies: JWT, Database, Redis Full OpenAPI schema support, even with several authentication backends In a hurry? Discover Fief, the open-source authentication platform \u00b6 Implementing registration, login, social auth is hard and painful. We know it. With our highly secure and open-source users management platform, you can focus on your app while staying in control of your users data. Based on FastAPI Users ! Open-source : self-host it for free or use our hosted version Bring your own database : host your database anywhere, we'll take care of the rest Pre-built login and registration pages : clean and fast authentication so you don't have to do it yourself Official Python client with built-in FastAPI integration It's free! Contributors and sponsors \u2728\u2615\ufe0f \u00b6 Thanks goes to these wonderful people ( emoji key ): Fran\u00e7ois Voron \ud83d\udea7 Paolo Dina \ud83d\udcb5 \ud83d\udcbb Dmytro Ohorodnik \ud83d\udc1b Matthew D. Scholefield \ud83d\udc1b roywes \ud83d\udc1b \ud83d\udcbb Satwik Kansal \ud83d\udcd6 Edd Salkield \ud83d\udcbb \ud83d\udcd6 mark-todd \ud83d\udcbb \ud83d\udcd6 lill74 \ud83d\udc1b \ud83d\udcbb \ud83d\udcd6 SelfhostedPro \ud83d\udee1\ufe0f \ud83d\udcbb Oskar Gmerek \ud83d\udcd6 Martin Collado \ud83d\udc1b \ud83d\udcbb Eric Lopes \ud83d\udcd6 \ud83d\udee1\ufe0f Beau Breon \ud83d\udcbb Niyas Mohammed \ud83d\udcd6 prostomarkeloff \ud83d\udcd6 \ud83d\udcbb Marius M\u00e9zerette \ud83d\udc1b \ud83e\udd14 Nickolas Grigoriadis \ud83d\udc1b Open Data Coder \ud83e\udd14 Mohammed Alshehri \ud83e\udd14 Tyler Renelle \ud83e\udd14 collerek \ud83d\udcbb Robert Bracco \ud83d\udcb5 Augusto Herrmann \ud83d\udcd6 Smithybrewer \ud83d\udc1b silllli \ud83d\udcd6 alexferrari88 \ud83d\udcb5 sandalwoodbox \ud83d\udc1b \ud83d\udcd6 Vlad Hoi \ud83d\udcd6 Joe Nudell \ud83d\udc1b Ben \ud83d\udcbb BoYanZh \ud83d\udcd6 David Brochart \ud83d\udcd6 \ud83d\udcbb Daan Beverdam \ud83d\udcbb St\u00e9phane Raimbault \u26a0\ufe0f \ud83d\udc1b Sondre Lilleb\u00f8 Gundersen \ud83d\udcd6 Maxim \ud83d\udcd6 \ud83d\udc1b scottdavort \ud83d\udcb5 John Dukewich \ud83d\udcd6 Yasser Tahiri \ud83d\udcbb Brandon H. Goding \ud83d\udcbb PovilasK \ud83d\udcbb Just van den Broecke \ud83d\udcb5 jakemanger \ud83d\udc1b \ud83d\udcbb Ikko Ashimine \ud83d\udcbb Maty\u00e1\u0161 Richter \ud83d\udcbb Hazedd \ud83d\udc1b \ud83d\udcd6 Luis Roel \ud83d\udcb5 Alexandr Makurin \ud83d\udcbb \ud83d\udc1b Leon Thurner \ud83d\udcd6 Goran Meki\u0107 \ud83d\udce6 Gaganpreet \ud83d\udcbb Joe Taylor \ud83d\udcbb Richard Friberg \ud83d\udc1b Kenton Parton \ud83d\udcb5 Adrian Cio\u0142ek \ud83d\udc1b \u2b55Alexander Rymdeko-Harvey \ud83d\udcd6 schwannden \ud83d\udea7 \ud83d\udcbb Jimmy Angel P\u00e9rez D\u00edaz \ud83d\udee1\ufe0f Austin Orr \ud83d\udea7 Carlo Eugster \ud83d\udee1\ufe0f Vittorio Zamboni \ud83d\udcbb Andrey \ud83d\udcd6 Can H. Tartanoglu \ud83d\udc1b Filipe Nascimento \ud83d\udee1\ufe0f dudulu \ud83d\udcb5 Toni Alatalo \ud83d\udcbb \ud83d\udcd6 This project follows the all-contributors specification. Contributions of any kind welcome! Development \u00b6 Setup environment \u00b6 We use Hatch to manage the development environment and production build. Ensure it's installed on your system. Run unit tests \u00b6 You can run all the tests with: hatch run test Format the code \u00b6 Execute the following command to apply isort and black formatting: hatch run lint Serve the documentation \u00b6 You can serve the documentation locally with the following command: hatch run docs The documentation will be available on http://localhost:8000 . License \u00b6 This project is licensed under the terms of the MIT license.","title":"About"},{"location":"#fastapi-users","text":"Ready-to-use and customizable users management for FastAPI Documentation : https://fastapi-users.github.io/fastapi-users/ Source Code : https://github.com/fastapi-users/fastapi-users Add quickly a registration and authentication system to your FastAPI project. FastAPI Users is designed to be as customizable and adaptable as possible.","title":"FastAPI Users"},{"location":"#features","text":"Extensible base user model Ready-to-use register, login, reset password and verify e-mail routes Ready-to-use social OAuth2 login flow Dependency callables to inject current user in route Pluggable password validation Customizable database backend SQLAlchemy ORM async included MongoDB with Beanie ODM included Multiple customizable authentication backends Transports: Authorization header, Cookie Strategies: JWT, Database, Redis Full OpenAPI schema support, even with several authentication backends","title":"Features"},{"location":"#in-a-hurry-discover-fief-the-open-source-authentication-platform","text":"Implementing registration, login, social auth is hard and painful. We know it. With our highly secure and open-source users management platform, you can focus on your app while staying in control of your users data. Based on FastAPI Users ! Open-source : self-host it for free or use our hosted version Bring your own database : host your database anywhere, we'll take care of the rest Pre-built login and registration pages : clean and fast authentication so you don't have to do it yourself Official Python client with built-in FastAPI integration It's free!","title":"In a hurry? Discover Fief, the open-source authentication platform"},{"location":"#contributors-and-sponsors","text":"Thanks goes to these wonderful people ( emoji key ): Fran\u00e7ois Voron \ud83d\udea7 Paolo Dina \ud83d\udcb5 \ud83d\udcbb Dmytro Ohorodnik \ud83d\udc1b Matthew D. Scholefield \ud83d\udc1b roywes \ud83d\udc1b \ud83d\udcbb Satwik Kansal \ud83d\udcd6 Edd Salkield \ud83d\udcbb \ud83d\udcd6 mark-todd \ud83d\udcbb \ud83d\udcd6 lill74 \ud83d\udc1b \ud83d\udcbb \ud83d\udcd6 SelfhostedPro \ud83d\udee1\ufe0f \ud83d\udcbb Oskar Gmerek \ud83d\udcd6 Martin Collado \ud83d\udc1b \ud83d\udcbb Eric Lopes \ud83d\udcd6 \ud83d\udee1\ufe0f Beau Breon \ud83d\udcbb Niyas Mohammed \ud83d\udcd6 prostomarkeloff \ud83d\udcd6 \ud83d\udcbb Marius M\u00e9zerette \ud83d\udc1b \ud83e\udd14 Nickolas Grigoriadis \ud83d\udc1b Open Data Coder \ud83e\udd14 Mohammed Alshehri \ud83e\udd14 Tyler Renelle \ud83e\udd14 collerek \ud83d\udcbb Robert Bracco \ud83d\udcb5 Augusto Herrmann \ud83d\udcd6 Smithybrewer \ud83d\udc1b silllli \ud83d\udcd6 alexferrari88 \ud83d\udcb5 sandalwoodbox \ud83d\udc1b \ud83d\udcd6 Vlad Hoi \ud83d\udcd6 Joe Nudell \ud83d\udc1b Ben \ud83d\udcbb BoYanZh \ud83d\udcd6 David Brochart \ud83d\udcd6 \ud83d\udcbb Daan Beverdam \ud83d\udcbb St\u00e9phane Raimbault \u26a0\ufe0f \ud83d\udc1b Sondre Lilleb\u00f8 Gundersen \ud83d\udcd6 Maxim \ud83d\udcd6 \ud83d\udc1b scottdavort \ud83d\udcb5 John Dukewich \ud83d\udcd6 Yasser Tahiri \ud83d\udcbb Brandon H. Goding \ud83d\udcbb PovilasK \ud83d\udcbb Just van den Broecke \ud83d\udcb5 jakemanger \ud83d\udc1b \ud83d\udcbb Ikko Ashimine \ud83d\udcbb Maty\u00e1\u0161 Richter \ud83d\udcbb Hazedd \ud83d\udc1b \ud83d\udcd6 Luis Roel \ud83d\udcb5 Alexandr Makurin \ud83d\udcbb \ud83d\udc1b Leon Thurner \ud83d\udcd6 Goran Meki\u0107 \ud83d\udce6 Gaganpreet \ud83d\udcbb Joe Taylor \ud83d\udcbb Richard Friberg \ud83d\udc1b Kenton Parton \ud83d\udcb5 Adrian Cio\u0142ek \ud83d\udc1b \u2b55Alexander Rymdeko-Harvey \ud83d\udcd6 schwannden \ud83d\udea7 \ud83d\udcbb Jimmy Angel P\u00e9rez D\u00edaz \ud83d\udee1\ufe0f Austin Orr \ud83d\udea7 Carlo Eugster \ud83d\udee1\ufe0f Vittorio Zamboni \ud83d\udcbb Andrey \ud83d\udcd6 Can H. Tartanoglu \ud83d\udc1b Filipe Nascimento \ud83d\udee1\ufe0f dudulu \ud83d\udcb5 Toni Alatalo \ud83d\udcbb \ud83d\udcd6 This project follows the all-contributors specification. Contributions of any kind welcome!","title":"Contributors and sponsors \u2728\u2615\ufe0f"},{"location":"#development","text":"","title":"Development"},{"location":"#setup-environment","text":"We use Hatch to manage the development environment and production build. Ensure it's installed on your system.","title":"Setup environment"},{"location":"#run-unit-tests","text":"You can run all the tests with: hatch run test","title":"Run unit tests"},{"location":"#format-the-code","text":"Execute the following command to apply isort and black formatting: hatch run lint","title":"Format the code"},{"location":"#serve-the-documentation","text":"You can serve the documentation locally with the following command: hatch run docs The documentation will be available on http://localhost:8000 .","title":"Serve the documentation"},{"location":"#license","text":"This project is licensed under the terms of the MIT license.","title":"License"},{"location":"installation/","text":"Installation \u00b6 You can add FastAPI Users to your FastAPI project in a few easy steps. First of all, install the dependency: With SQLAlchemy support \u00b6 pip install 'fastapi-users[sqlalchemy]' With Beanie support \u00b6 pip install 'fastapi-users[beanie]' With Redis authentication backend support \u00b6 Information on installing with proper database support can be found in the Redis section. With OAuth2 support \u00b6 Information on installing with proper database support can be found in the OAuth2 section. That's it! In the next section, we'll have an overview of how things work.","title":"Installation"},{"location":"installation/#installation","text":"You can add FastAPI Users to your FastAPI project in a few easy steps. First of all, install the dependency:","title":"Installation"},{"location":"installation/#with-sqlalchemy-support","text":"pip install 'fastapi-users[sqlalchemy]'","title":"With SQLAlchemy support"},{"location":"installation/#with-beanie-support","text":"pip install 'fastapi-users[beanie]'","title":"With Beanie support"},{"location":"installation/#with-redis-authentication-backend-support","text":"Information on installing with proper database support can be found in the Redis section.","title":"With Redis authentication backend support"},{"location":"installation/#with-oauth2-support","text":"Information on installing with proper database support can be found in the OAuth2 section. That's it! In the next section, we'll have an overview of how things work.","title":"With OAuth2 support"},{"location":"configuration/full-example/","text":"Full example \u00b6 Here is a full working example with JWT authentication to help get you started. Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database. SQLAlchemy \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True ) Beanie \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True ) What now? \u00b6 You're ready to go! Be sure to check the Usage section to understand how to work with FastAPI Users .","title":"Full example"},{"location":"configuration/full-example/#full-example","text":"Here is a full working example with JWT authentication to help get you started. Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database.","title":"Full example"},{"location":"configuration/full-example/#sqlalchemy","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"SQLAlchemy"},{"location":"configuration/full-example/#beanie","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import auth_backend , current_active_user , fastapi_users app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from app.db import User , get_user_db SECRET = \"SECRET\" class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"Beanie"},{"location":"configuration/full-example/#what-now","text":"You're ready to go! Be sure to check the Usage section to understand how to work with FastAPI Users .","title":"What now?"},{"location":"configuration/oauth/","text":"OAuth2 \u00b6 FastAPI Users provides an optional OAuth2 authentication support. It relies on HTTPX OAuth library , which is a pure-async implementation of OAuth2. Installation \u00b6 You should install the library with the optional dependencies for OAuth: pip install 'fastapi-users[sqlalchemy,oauth]' pip install 'fastapi-users[beanie,oauth]' Configuration \u00b6 Instantiate an OAuth2 client \u00b6 You first need to get an HTTPX OAuth client instance. Read the documentation for more information. from httpx_oauth.clients.google import GoogleOAuth2 google_oauth_client = GoogleOAuth2 ( \"CLIENT_ID\" , \"CLIENT_SECRET\" ) Setup the database adapter \u00b6 SQLAlchemy \u00b6 You'll need to define the SQLAlchemy model for storing OAuth accounts. We provide a base one for this: from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) Notice that we also manually added a relationship on the UserTable so that SQLAlchemy can properly retrieve the OAuth accounts of the user. Besides, when instantiating the database adapter, we need pass this SQLAlchemy model as third argument. Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseOAuthAccountTable as base class and define your own id and user_id column. class OAuthAccount ( SQLAlchemyBaseOAuthAccountTable [ int ], Base ): id = Column ( Integer , primary_key = True ) @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseOAuthAccountTable expects a generic type to define the actual type of ID you use. Beanie \u00b6 The advantage of MongoDB is that you can easily embed sub-objects in a single document. That's why the configuration for Beanie is quite simple. All we need to do is to define another class to structure an OAuth account object. from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) It's worth to note that OAuthAccount is not a Beanie document but a Pydantic model that we'll embed inside the User document, through the oauth_accounts array. Generate routers \u00b6 Once you have a FastAPIUsers instance, you can make it generate a single OAuth router for a given client and authentication backend. app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Tip If you have several OAuth clients and/or several authentication backends, you'll need to create a router for each pair you want to support. Existing account association \u00b6 If a user with the same e-mail address already exists, an HTTP 400 error will be raised by default. You can however choose to automatically link this OAuth account to the existing user account by setting the associate_by_email flag: app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" , associate_by_email = True , ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Bear in mind though that it can lead to security breaches if the OAuth provider does not validate e-mail addresses. How? Let's say your app support an OAuth provider, Merlinbook , which does not validate e-mail addresses. Imagine a user registers to your app with the e-mail address lancelot@camelot.bt . Now, a malicious user creates an account on Merlinbook with the same e-mail address. Without e-mail validation, the malicious user can use this account without limitation. The malicious user authenticates using Merlinbook OAuth on your app, which automatically associates to the existing lancelot@camelot.bt . Now, the malicious user has full access to the user account on your app \ud83d\ude1e Association router for authenticated users \u00b6 We also provide a router to associate an already authenticated user with an OAuth account. After this association, the user will be able to authenticate with this OAuth provider. app . include_router ( fastapi_users . get_oauth_associate_router ( google_oauth_client , UserRead , \"SECRET\" ), prefix = \"/auth/associate/google\" , tags = [ \"auth\" ], ) Notice that, just like for the Users router , you have to pass the UserRead Pydantic schema. Full example \u00b6 Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database. SQLAlchemy \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True ) Beanie \u00b6 Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"OAuth2"},{"location":"configuration/oauth/#oauth2","text":"FastAPI Users provides an optional OAuth2 authentication support. It relies on HTTPX OAuth library , which is a pure-async implementation of OAuth2.","title":"OAuth2"},{"location":"configuration/oauth/#installation","text":"You should install the library with the optional dependencies for OAuth: pip install 'fastapi-users[sqlalchemy,oauth]' pip install 'fastapi-users[beanie,oauth]'","title":"Installation"},{"location":"configuration/oauth/#configuration","text":"","title":"Configuration"},{"location":"configuration/oauth/#instantiate-an-oauth2-client","text":"You first need to get an HTTPX OAuth client instance. Read the documentation for more information. from httpx_oauth.clients.google import GoogleOAuth2 google_oauth_client = GoogleOAuth2 ( \"CLIENT_ID\" , \"CLIENT_SECRET\" )","title":"Instantiate an OAuth2 client"},{"location":"configuration/oauth/#setup-the-database-adapter","text":"","title":"Setup the database adapter"},{"location":"configuration/oauth/#sqlalchemy","text":"You'll need to define the SQLAlchemy model for storing OAuth accounts. We provide a base one for this: from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) Notice that we also manually added a relationship on the UserTable so that SQLAlchemy can properly retrieve the OAuth accounts of the user. Besides, when instantiating the database adapter, we need pass this SQLAlchemy model as third argument. Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseOAuthAccountTable as base class and define your own id and user_id column. class OAuthAccount ( SQLAlchemyBaseOAuthAccountTable [ int ], Base ): id = Column ( Integer , primary_key = True ) @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseOAuthAccountTable expects a generic type to define the actual type of ID you use.","title":"SQLAlchemy"},{"location":"configuration/oauth/#beanie","text":"The advantage of MongoDB is that you can easily embed sub-objects in a single document. That's why the configuration for Beanie is quite simple. All we need to do is to define another class to structure an OAuth account object. from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) It's worth to note that OAuthAccount is not a Beanie document but a Pydantic model that we'll embed inside the User document, through the oauth_accounts array.","title":"Beanie"},{"location":"configuration/oauth/#generate-routers","text":"Once you have a FastAPIUsers instance, you can make it generate a single OAuth router for a given client and authentication backend. app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Tip If you have several OAuth clients and/or several authentication backends, you'll need to create a router for each pair you want to support.","title":"Generate routers"},{"location":"configuration/oauth/#existing-account-association","text":"If a user with the same e-mail address already exists, an HTTP 400 error will be raised by default. You can however choose to automatically link this OAuth account to the existing user account by setting the associate_by_email flag: app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" , associate_by_email = True , ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) Bear in mind though that it can lead to security breaches if the OAuth provider does not validate e-mail addresses. How? Let's say your app support an OAuth provider, Merlinbook , which does not validate e-mail addresses. Imagine a user registers to your app with the e-mail address lancelot@camelot.bt . Now, a malicious user creates an account on Merlinbook with the same e-mail address. Without e-mail validation, the malicious user can use this account without limitation. The malicious user authenticates using Merlinbook OAuth on your app, which automatically associates to the existing lancelot@camelot.bt . Now, the malicious user has full access to the user account on your app \ud83d\ude1e","title":"Existing account association"},{"location":"configuration/oauth/#association-router-for-authenticated-users","text":"We also provide a router to associate an already authenticated user with an OAuth account. After this association, the user will be able to authenticate with this OAuth provider. app . include_router ( fastapi_users . get_oauth_associate_router ( google_oauth_client , UserRead , \"SECRET\" ), prefix = \"/auth/associate/google\" , tags = [ \"auth\" ], ) Notice that, just like for the Users router , you have to pass the UserRead Pydantic schema.","title":"Association router for authenticated users"},{"location":"configuration/oauth/#full-example","text":"Warning Notice that SECRET should be changed to a strong passphrase. Insecure passwords may give attackers full access to your database.","title":"Full example"},{"location":"configuration/oauth/#sqlalchemy_1","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from fastapi import Depends , FastAPI from app.db import User , create_db_and_tables from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): # Not needed if you setup a migration system like Alembic await create_db_and_tables () from typing import AsyncGenerator , List from fastapi import Depends from fastapi_users.db import ( SQLAlchemyBaseOAuthAccountTableUUID , SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import relationship , sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class OAuthAccount ( SQLAlchemyBaseOAuthAccountTableUUID , Base ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): oauth_accounts : List [ OAuthAccount ] = relationship ( \"OAuthAccount\" , lazy = \"joined\" ) engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User , OAuthAccount ) import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers , UUIDIDMixin from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import SQLAlchemyUserDatabase from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"SQLAlchemy"},{"location":"configuration/oauth/#beanie_1","text":"Open requirements.txt main.py app/app.py app/db.py app/schemas.py app/users.py fastapi fastapi-users[beanie] uvicorn[standard] import uvicorn if __name__ == \"__main__\" : uvicorn . run ( \"app.app:app\" , host = \"0.0.0.0\" , log_level = \"info\" ) from beanie import init_beanie from fastapi import Depends , FastAPI from app.db import User , db from app.schemas import UserCreate , UserRead , UserUpdate from app.users import ( SECRET , auth_backend , current_active_user , fastapi_users , google_oauth_client , ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , SECRET ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) @app . get ( \"/authenticated-route\" ) async def authenticated_route ( user : User = Depends ( current_active_user )): return { \"message\" : f \"Hello { user . email } !\" } @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) from typing import List import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BaseOAuthAccount , BeanieBaseUser , BeanieUserDatabase from pydantic import Field DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class OAuthAccount ( BaseOAuthAccount ): pass class User ( BeanieBaseUser [ PydanticObjectId ]): oauth_accounts : List [ OAuthAccount ] = Field ( default_factory = list ) async def get_user_db (): yield BeanieUserDatabase ( User , OAuthAccount ) from beanie import PydanticObjectId from fastapi_users import schemas class UserRead ( schemas . BaseUser [ PydanticObjectId ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass import os from typing import Optional from beanie import PydanticObjectId from fastapi import Depends , Request from fastapi_users import BaseUserManager , FastAPIUsers from fastapi_users.authentication import ( AuthenticationBackend , BearerTransport , JWTStrategy , ) from fastapi_users.db import BeanieUserDatabase , ObjectIDIDMixin from httpx_oauth.clients.google import GoogleOAuth2 from app.db import User , get_user_db SECRET = \"SECRET\" google_oauth_client = GoogleOAuth2 ( os . getenv ( \"GOOGLE_OAUTH_CLIENT_ID\" , \"\" ), os . getenv ( \"GOOGLE_OAUTH_CLIENT_SECRET\" , \"\" ), ) class UserManager ( ObjectIDIDMixin , BaseUserManager [ User , PydanticObjectId ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db : BeanieUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) fastapi_users = FastAPIUsers [ User , PydanticObjectId ]( get_user_manager , [ auth_backend ]) current_active_user = fastapi_users . current_user ( active = True )","title":"Beanie"},{"location":"configuration/overview/","text":"Overview \u00b6 The schema below shows you how the library is structured and how each part fit together. flowchart TB FASTAPI_USERS{FastAPIUsers} USER_MANAGER{UserManager} USER_MODEL{User model} DATABASE_DEPENDENCY[[get_user_db]] USER_MANAGER_DEPENDENCY[[get_user_manager]] CURRENT_USER[[current_user]] subgraph SCHEMAS[Schemas] USER[User] USER_CREATE[UserCreate] USER_UPDATE[UserUpdate] end subgraph DATABASE[Database adapters] SQLALCHEMY[SQLAlchemy] BEANIE[Beanie] end subgraph ROUTERS[Routers] AUTH[[get_auth_router]] OAUTH[[get_oauth_router]] OAUTH_ASSOCIATE[[get_oauth_associate_router]] REGISTER[[get_register_router]] VERIFY[[get_verify_router]] RESET[[get_reset_password_router]] USERS[[get_users_router]] end subgraph AUTH_BACKENDS[Authentication] subgraph TRANSPORTS[Transports] COOKIE[CookieTransport] BEARER[BearerTransport] end subgraph STRATEGIES[Strategies] DB[DatabaseStrategy] JWT[JWTStrategy] REDIS[RedisStrategy] end AUTH_BACKEND{AuthenticationBackend} end DATABASE --> DATABASE_DEPENDENCY USER_MODEL --> DATABASE_DEPENDENCY DATABASE_DEPENDENCY --> USER_MANAGER USER_MANAGER --> USER_MANAGER_DEPENDENCY USER_MANAGER_DEPENDENCY --> FASTAPI_USERS FASTAPI_USERS --> ROUTERS TRANSPORTS --> AUTH_BACKEND STRATEGIES --> AUTH_BACKEND AUTH_BACKEND --> ROUTERS AUTH_BACKEND --> FASTAPI_USERS FASTAPI_USERS --> CURRENT_USER SCHEMAS --> ROUTERS User model and database adapters \u00b6 FastAPI Users is compatible with various databases and ORM . To build the interface between those database tools and the library, we provide database adapters classes that you need to instantiate and configure. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using Beanie Authentication backends \u00b6 Authentication backends define the way users sessions are managed in your app, like access tokens or cookies. They are composed of two parts: a transport , which is how the token will be carried over the requests (e.g. cookies, headers...) and a strategy , which is how the token will be generated and secured (e.g. a JWT, a token in database...). \u27a1\ufe0f Configure the authentication backends UserManager \u00b6 The UserManager object bears most of the logic of FastAPI Users: registration, verification, password reset... We provide a BaseUserManager with this common logic; which you should overload to define how to validate passwords or handle events. This UserManager object should be provided through a FastAPI dependency, get_user_manager . \u27a1\ufe0f Configure UserManager Schemas \u00b6 FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. \u27a1\ufe0f Configure schemas FastAPIUsers and routers \u00b6 Finally, FastAPIUsers object is the main class from which you'll be able to generate routers for classic routes like registration or login, but also get the current_user dependency factory to inject the authenticated user in your own routes. \u27a1\ufe0f Configure FastAPIUsers and routers","title":"Overview"},{"location":"configuration/overview/#overview","text":"The schema below shows you how the library is structured and how each part fit together. flowchart TB FASTAPI_USERS{FastAPIUsers} USER_MANAGER{UserManager} USER_MODEL{User model} DATABASE_DEPENDENCY[[get_user_db]] USER_MANAGER_DEPENDENCY[[get_user_manager]] CURRENT_USER[[current_user]] subgraph SCHEMAS[Schemas] USER[User] USER_CREATE[UserCreate] USER_UPDATE[UserUpdate] end subgraph DATABASE[Database adapters] SQLALCHEMY[SQLAlchemy] BEANIE[Beanie] end subgraph ROUTERS[Routers] AUTH[[get_auth_router]] OAUTH[[get_oauth_router]] OAUTH_ASSOCIATE[[get_oauth_associate_router]] REGISTER[[get_register_router]] VERIFY[[get_verify_router]] RESET[[get_reset_password_router]] USERS[[get_users_router]] end subgraph AUTH_BACKENDS[Authentication] subgraph TRANSPORTS[Transports] COOKIE[CookieTransport] BEARER[BearerTransport] end subgraph STRATEGIES[Strategies] DB[DatabaseStrategy] JWT[JWTStrategy] REDIS[RedisStrategy] end AUTH_BACKEND{AuthenticationBackend} end DATABASE --> DATABASE_DEPENDENCY USER_MODEL --> DATABASE_DEPENDENCY DATABASE_DEPENDENCY --> USER_MANAGER USER_MANAGER --> USER_MANAGER_DEPENDENCY USER_MANAGER_DEPENDENCY --> FASTAPI_USERS FASTAPI_USERS --> ROUTERS TRANSPORTS --> AUTH_BACKEND STRATEGIES --> AUTH_BACKEND AUTH_BACKEND --> ROUTERS AUTH_BACKEND --> FASTAPI_USERS FASTAPI_USERS --> CURRENT_USER SCHEMAS --> ROUTERS","title":"Overview"},{"location":"configuration/overview/#user-model-and-database-adapters","text":"FastAPI Users is compatible with various databases and ORM . To build the interface between those database tools and the library, we provide database adapters classes that you need to instantiate and configure. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using Beanie","title":"User model and database adapters"},{"location":"configuration/overview/#authentication-backends","text":"Authentication backends define the way users sessions are managed in your app, like access tokens or cookies. They are composed of two parts: a transport , which is how the token will be carried over the requests (e.g. cookies, headers...) and a strategy , which is how the token will be generated and secured (e.g. a JWT, a token in database...). \u27a1\ufe0f Configure the authentication backends","title":"Authentication backends"},{"location":"configuration/overview/#usermanager","text":"The UserManager object bears most of the logic of FastAPI Users: registration, verification, password reset... We provide a BaseUserManager with this common logic; which you should overload to define how to validate passwords or handle events. This UserManager object should be provided through a FastAPI dependency, get_user_manager . \u27a1\ufe0f Configure UserManager","title":"UserManager"},{"location":"configuration/overview/#schemas","text":"FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. \u27a1\ufe0f Configure schemas","title":"Schemas"},{"location":"configuration/overview/#fastapiusers-and-routers","text":"Finally, FastAPIUsers object is the main class from which you'll be able to generate routers for classic routes like registration or login, but also get the current_user dependency factory to inject the authenticated user in your own routes. \u27a1\ufe0f Configure FastAPIUsers and routers","title":"FastAPIUsers and routers"},{"location":"configuration/password-hash/","text":"Password hash \u00b6 By default, FastAPI Users will use the BCrypt algorithm to hash and salt passwords before storing them in the database. The implementation is provided by Passlib , a battle-tested Python library for password hashing. Customize CryptContext \u00b6 If you need to support other hashing algorithms, you can customize the CryptContext object of Passlib . For this, you'll need to instantiate the PasswordHelper class and pass it your CryptContext . The example below shows you how you can create a CryptContext to add support for the Argon2 algorithm while deprecating BCrypt. from fastapi_users.password import PasswordHelper from passlib.context import CryptContext context = CryptContext ( schemes = [ \"argon2\" , \"bcrypt\" ], deprecated = \"auto\" ) password_helper = PasswordHelper ( context ) Finally, pass the password_helper variable while instantiating your UserManager : async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db , password_helper ) Password hashes are automatically upgraded FastAPI Users takes care of upgrading the password hash to a more recent algorithm when needed. Typically, when a user logs in, we'll check if the password hash algorithm is deprecated. If it is, we take the opportunity of having the password in plain-text at hand (since the user just logged in!) to hash it with a better algorithm and update it in database. Dependencies for alternative algorithms are not included by default FastAPI Users won't install required dependencies to make other algorithms like Argon2 work. It's up to you to install them. Full customization \u00b6 If you don't wist to use Passlib at all \u2013 which we don't recommend unless you're absolutely sure of what you're doing \u2014 you can implement your own PasswordHelper class as long as it implements the PasswordHelperProtocol and its methods. from typing import Tuple from fastapi_users.password import PasswordHelperProtocol class PasswordHelper ( PasswordHelperProtocol ): def verify_and_update ( self , plain_password : str , hashed_password : str ) -> Tuple [ bool , str ]: ... def hash ( self , password : str ) -> str : ... def generate ( self ) -> str : ...","title":"Password hash"},{"location":"configuration/password-hash/#password-hash","text":"By default, FastAPI Users will use the BCrypt algorithm to hash and salt passwords before storing them in the database. The implementation is provided by Passlib , a battle-tested Python library for password hashing.","title":"Password hash"},{"location":"configuration/password-hash/#customize-cryptcontext","text":"If you need to support other hashing algorithms, you can customize the CryptContext object of Passlib . For this, you'll need to instantiate the PasswordHelper class and pass it your CryptContext . The example below shows you how you can create a CryptContext to add support for the Argon2 algorithm while deprecating BCrypt. from fastapi_users.password import PasswordHelper from passlib.context import CryptContext context = CryptContext ( schemes = [ \"argon2\" , \"bcrypt\" ], deprecated = \"auto\" ) password_helper = PasswordHelper ( context ) Finally, pass the password_helper variable while instantiating your UserManager : async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db , password_helper ) Password hashes are automatically upgraded FastAPI Users takes care of upgrading the password hash to a more recent algorithm when needed. Typically, when a user logs in, we'll check if the password hash algorithm is deprecated. If it is, we take the opportunity of having the password in plain-text at hand (since the user just logged in!) to hash it with a better algorithm and update it in database. Dependencies for alternative algorithms are not included by default FastAPI Users won't install required dependencies to make other algorithms like Argon2 work. It's up to you to install them.","title":"Customize CryptContext"},{"location":"configuration/password-hash/#full-customization","text":"If you don't wist to use Passlib at all \u2013 which we don't recommend unless you're absolutely sure of what you're doing \u2014 you can implement your own PasswordHelper class as long as it implements the PasswordHelperProtocol and its methods. from typing import Tuple from fastapi_users.password import PasswordHelperProtocol class PasswordHelper ( PasswordHelperProtocol ): def verify_and_update ( self , plain_password : str , hashed_password : str ) -> Tuple [ bool , str ]: ... def hash ( self , password : str ) -> str : ... def generate ( self ) -> str : ...","title":"Full customization"},{"location":"configuration/schemas/","text":"Schemas \u00b6 FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. It's different from your User model , which is an object that actually interacts with the database. Those schemas on the other hand are here to validate data and serialize correct it in the API. FastAPI Users provides a base structure to cover its needs. It is structured like this: id ( ID ) \u2013 Unique identifier of the user. It matches the type of your ID, like UUID or integer. email ( str ) \u2013 Email of the user. Validated by email-validator . is_active ( bool ) \u2013 Whether or not the user is active. If not, login and forgot password requests will be denied. Defaults to True . is_verified ( bool ) \u2013 Whether or not the user is verified. Optional but helpful with the verify router logic. Defaults to False . is_superuser ( bool ) \u2013 Whether or not the user is a superuser. Useful to implement administration logic. Defaults to False . Define your schemas \u00b6 There are four Pydantic models variations provided as mixins: BaseUser , which provides the basic fields and validation; BaseCreateUser , dedicated to user registration, which consists of compulsory email and password fields; BaseUpdateUser , dedicated to user profile update, which adds an optional password field; You should define each of those variations, inheriting from each mixin: import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass Typing: ID generic type is expected You can see that we define a generic type when extending the BaseUser class. It should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. Adding your own fields \u00b6 You can of course add your own properties there to fit to your needs. In the example below, we add a required string property, first_name , and an optional date property, birthdate . import datetime import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): first_name : str birthdate : Optional [ datetime . date ] class UserCreate ( schemas . BaseUserCreate ): first_name : str birthdate : Optional [ datetime . date ] class UserUpdate ( schemas . BaseUserUpdate ): first_name : Optional [ str ] birthdate : Optional [ datetime . date ] Make sure to mirror this in your database model The User model you defined earlier for your specific database will be the central object that will actually store the data. Therefore, you need to define the very same fields in it so the data can be actually stored.","title":"Schemas"},{"location":"configuration/schemas/#schemas","text":"FastAPI is heavily using Pydantic models to validate request payloads and serialize responses. FastAPI Users is no exception and will expect you to provide Pydantic schemas representing a user when it's read, created and updated. It's different from your User model , which is an object that actually interacts with the database. Those schemas on the other hand are here to validate data and serialize correct it in the API. FastAPI Users provides a base structure to cover its needs. It is structured like this: id ( ID ) \u2013 Unique identifier of the user. It matches the type of your ID, like UUID or integer. email ( str ) \u2013 Email of the user. Validated by email-validator . is_active ( bool ) \u2013 Whether or not the user is active. If not, login and forgot password requests will be denied. Defaults to True . is_verified ( bool ) \u2013 Whether or not the user is verified. Optional but helpful with the verify router logic. Defaults to False . is_superuser ( bool ) \u2013 Whether or not the user is a superuser. Useful to implement administration logic. Defaults to False .","title":"Schemas"},{"location":"configuration/schemas/#define-your-schemas","text":"There are four Pydantic models variations provided as mixins: BaseUser , which provides the basic fields and validation; BaseCreateUser , dedicated to user registration, which consists of compulsory email and password fields; BaseUpdateUser , dedicated to user profile update, which adds an optional password field; You should define each of those variations, inheriting from each mixin: import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass Typing: ID generic type is expected You can see that we define a generic type when extending the BaseUser class. It should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID.","title":"Define your schemas"},{"location":"configuration/schemas/#adding-your-own-fields","text":"You can of course add your own properties there to fit to your needs. In the example below, we add a required string property, first_name , and an optional date property, birthdate . import datetime import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): first_name : str birthdate : Optional [ datetime . date ] class UserCreate ( schemas . BaseUserCreate ): first_name : str birthdate : Optional [ datetime . date ] class UserUpdate ( schemas . BaseUserUpdate ): first_name : Optional [ str ] birthdate : Optional [ datetime . date ] Make sure to mirror this in your database model The User model you defined earlier for your specific database will be the central object that will actually store the data. Therefore, you need to define the very same fields in it so the data can be actually stored.","title":"Adding your own fields"},{"location":"configuration/user-manager/","text":"UserManager \u00b6 The UserManager class is the core logic of FastAPI Users. We provide the BaseUserManager class which you should extend to set some parameters and define logic, for example when a user just registered or forgot its password. It's designed to be easily extensible and customizable so that you can integrate your very own logic. Create your UserManager class \u00b6 You should define your own version of the UserManager class to set various parameters. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) As you can see, you have to define here various attributes and methods. You can find the complete list of those below. Typing: User and ID generic types are expected You can see that we define two generic types when extending the base class: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion when implementing the custom methods. The ID parser mixin \u00b6 Since the user ID is fully generic, we need a way to parse it reliably when it'll come from API requests , typically as URL path attributes. That's why we added the UUIDIDMixin in the example above. It implements the parse_id method, ensuring UUID are valid and correctly parsed. Of course, it's important that this logic matches the type of your ID . To help you with this, we provide mixins for the most common cases: UUIDIDMixin , for UUID ID. IntegerIDMixin , for integer ID. ObjectIDIDMixin (provided by fastapi_users_db_beanie ), for MongoDB ObjectID. Inheritance order matters Notice in your example that the mixin comes first in our UserManager inheritance . Because of the Method-Resolution-Order (MRO) of Python, the left-most element takes precedence. If you need another type of ID, you can simply overload the parse_id method on your UserManager class: from fastapi_users import BaseUserManager , InvalidID class UserManager ( BaseUserManager [ User , MyCustomID ]): def parse_id ( self , value : Any ) -> MyCustomID : try : return MyCustomID ( value ) except ValueError as e : raise InvalidID () from e # (1)! If the ID can't be parsed into the desired type, you'll need to raise an InvalidID exception. Create get_user_manager dependency \u00b6 The UserManager class will be injected at runtime using a FastAPI dependency. This way, you can run it in a database session or swap it with a mock during testing. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) Notice that we use the get_user_db dependency we defined earlier to inject the database instance. Customize attributes and methods \u00b6 Attributes \u00b6 reset_password_token_secret : Secret to encode reset password token. Use a strong passphrase and keep it secure. reset_password_token_lifetime_seconds : Lifetime of reset password token. Defaults to 3600. reset_password_token_audience : JWT audience of reset password token. Defaults to fastapi-users:reset . verification_token_secret : Secret to encode verification token. Use a strong passphrase and keep it secure. verification_token_lifetime_seconds : Lifetime of verification token. Defaults to 3600. verification_token_audience : JWT audience of verification token. Defaults to fastapi-users:verify . Methods \u00b6 validate_password \u00b6 Validate a password. Arguments password ( str ): the password to validate. user ( Union[UserCreate, User] ): user model which we are currently validating the password. Useful if you want to check that the password doesn't contain the name or the birthdate of the user for example. Output This function should return None if the password is valid or raise InvalidPasswordException if not. This exception expects an argument reason telling why the password is invalid. It'll be part of the error response. Example from fastapi_users import BaseUserManager , InvalidPasswordException , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def validate_password ( self , password : str , user : Union [ UserCreate , User ], ) -> None : if len ( password ) < 8 : raise InvalidPasswordException ( reason = \"Password should be at least 8 characters\" ) if user . email in password : raise InvalidPasswordException ( reason = \"Password should not contain e-mail\" ) on_after_register \u00b6 Perform logic after successful user registration. Typically, you'll want to send a welcome e-mail or add it to your marketing analytics pipeline. Arguments user ( User ): the registered user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) on_after_update \u00b6 Perform logic after successful user update. It may be useful, for example, if you wish to update your user in a data analytics or customer success platform. Arguments user ( User ): the updated user. update_dict ( Dict[str, Any] ): dictionary with the updated user fields. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_update ( self , user : User , update_dict : Dict [ str , Any ], request : Optional [ Request ] = None , ): print ( f \"User { user . id } has been updated with { update_dict } .\" ) on_after_login \u00b6 Perform logic after a successful user login. It may be useful for custom logic or processes triggered by new logins, for example a daily login reward or for analytics. Arguments user ( User ): the updated user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_login ( self , user : User , request : Optional [ Request ] = None , ): print ( f \"User { user . id } logged in.\" ) on_after_request_verify \u00b6 Perform logic after successful verification request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to verify their e-mail. Arguments user ( User ): the user to verify. token ( str ): the verification token. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) on_after_verify \u00b6 Perform logic after successful user verification. This may be useful if you wish to send another e-mail or store this information in a data analytics or customer success platform. Arguments user ( User ): the verified user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_verify ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has been verified\" ) on_after_forgot_password \u00b6 Perform logic after successful forgot password request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to reset their password. Arguments user ( User ): the user that forgot its password. token ( str ): the forgot password token request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) on_after_reset_password \u00b6 Perform logic after successful password reset. For example, you may want to send an e-mail to the concerned user to warn him that their password has been changed and that they should take action if they think they have been hacked. Arguments user ( User ): the user that reset its password. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_reset_password ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has reset their password.\" ) on_before_delete \u00b6 Perform logic before user delete. For example, you may want to valide user resource integrity to see if any related user resource need to be marked inactive, or delete them recursively. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_before_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is going to be deleted\" ) on_after_delete \u00b6 Perform logic after user delete. For example, you may want to send an email to the administrator about the event. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is successfully deleted\" )","title":"UserManager"},{"location":"configuration/user-manager/#usermanager","text":"The UserManager class is the core logic of FastAPI Users. We provide the BaseUserManager class which you should extend to set some parameters and define logic, for example when a user just registered or forgot its password. It's designed to be easily extensible and customizable so that you can integrate your very own logic.","title":"UserManager"},{"location":"configuration/user-manager/#create-your-usermanager-class","text":"You should define your own version of the UserManager class to set various parameters. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) As you can see, you have to define here various attributes and methods. You can find the complete list of those below. Typing: User and ID generic types are expected You can see that we define two generic types when extending the base class: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion when implementing the custom methods.","title":"Create your UserManager class"},{"location":"configuration/user-manager/#the-id-parser-mixin","text":"Since the user ID is fully generic, we need a way to parse it reliably when it'll come from API requests , typically as URL path attributes. That's why we added the UUIDIDMixin in the example above. It implements the parse_id method, ensuring UUID are valid and correctly parsed. Of course, it's important that this logic matches the type of your ID . To help you with this, we provide mixins for the most common cases: UUIDIDMixin , for UUID ID. IntegerIDMixin , for integer ID. ObjectIDIDMixin (provided by fastapi_users_db_beanie ), for MongoDB ObjectID. Inheritance order matters Notice in your example that the mixin comes first in our UserManager inheritance . Because of the Method-Resolution-Order (MRO) of Python, the left-most element takes precedence. If you need another type of ID, you can simply overload the parse_id method on your UserManager class: from fastapi_users import BaseUserManager , InvalidID class UserManager ( BaseUserManager [ User , MyCustomID ]): def parse_id ( self , value : Any ) -> MyCustomID : try : return MyCustomID ( value ) except ValueError as e : raise InvalidID () from e # (1)! If the ID can't be parsed into the desired type, you'll need to raise an InvalidID exception.","title":"The ID parser mixin"},{"location":"configuration/user-manager/#create-get_user_manager-dependency","text":"The UserManager class will be injected at runtime using a FastAPI dependency. This way, you can run it in a database session or swap it with a mock during testing. import uuid from typing import Optional from fastapi import Depends , Request from fastapi_users import BaseUserManager , UUIDIDMixin from .db import User , get_user_db SECRET = \"SECRET\" class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) async def get_user_manager ( user_db = Depends ( get_user_db )): yield UserManager ( user_db ) Notice that we use the get_user_db dependency we defined earlier to inject the database instance.","title":"Create get_user_manager dependency"},{"location":"configuration/user-manager/#customize-attributes-and-methods","text":"","title":"Customize attributes and methods"},{"location":"configuration/user-manager/#attributes","text":"reset_password_token_secret : Secret to encode reset password token. Use a strong passphrase and keep it secure. reset_password_token_lifetime_seconds : Lifetime of reset password token. Defaults to 3600. reset_password_token_audience : JWT audience of reset password token. Defaults to fastapi-users:reset . verification_token_secret : Secret to encode verification token. Use a strong passphrase and keep it secure. verification_token_lifetime_seconds : Lifetime of verification token. Defaults to 3600. verification_token_audience : JWT audience of verification token. Defaults to fastapi-users:verify .","title":"Attributes"},{"location":"configuration/user-manager/#methods","text":"","title":"Methods"},{"location":"configuration/user-manager/#validate_password","text":"Validate a password. Arguments password ( str ): the password to validate. user ( Union[UserCreate, User] ): user model which we are currently validating the password. Useful if you want to check that the password doesn't contain the name or the birthdate of the user for example. Output This function should return None if the password is valid or raise InvalidPasswordException if not. This exception expects an argument reason telling why the password is invalid. It'll be part of the error response. Example from fastapi_users import BaseUserManager , InvalidPasswordException , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def validate_password ( self , password : str , user : Union [ UserCreate , User ], ) -> None : if len ( password ) < 8 : raise InvalidPasswordException ( reason = \"Password should be at least 8 characters\" ) if user . email in password : raise InvalidPasswordException ( reason = \"Password should not contain e-mail\" )","title":"validate_password"},{"location":"configuration/user-manager/#on_after_register","text":"Perform logic after successful user registration. Typically, you'll want to send a welcome e-mail or add it to your marketing analytics pipeline. Arguments user ( User ): the registered user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" )","title":"on_after_register"},{"location":"configuration/user-manager/#on_after_update","text":"Perform logic after successful user update. It may be useful, for example, if you wish to update your user in a data analytics or customer success platform. Arguments user ( User ): the updated user. update_dict ( Dict[str, Any] ): dictionary with the updated user fields. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_update ( self , user : User , update_dict : Dict [ str , Any ], request : Optional [ Request ] = None , ): print ( f \"User { user . id } has been updated with { update_dict } .\" )","title":"on_after_update"},{"location":"configuration/user-manager/#on_after_login","text":"Perform logic after a successful user login. It may be useful for custom logic or processes triggered by new logins, for example a daily login reward or for analytics. Arguments user ( User ): the updated user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_login ( self , user : User , request : Optional [ Request ] = None , ): print ( f \"User { user . id } logged in.\" )","title":"on_after_login"},{"location":"configuration/user-manager/#on_after_request_verify","text":"Perform logic after successful verification request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to verify their e-mail. Arguments user ( User ): the user to verify. token ( str ): the verification token. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" )","title":"on_after_request_verify"},{"location":"configuration/user-manager/#on_after_verify","text":"Perform logic after successful user verification. This may be useful if you wish to send another e-mail or store this information in a data analytics or customer success platform. Arguments user ( User ): the verified user. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_verify ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has been verified\" )","title":"on_after_verify"},{"location":"configuration/user-manager/#on_after_forgot_password","text":"Perform logic after successful forgot password request. Typically, you'll want to send an e-mail with the link (and the token) that allows the user to reset their password. Arguments user ( User ): the user that forgot its password. token ( str ): the forgot password token request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" )","title":"on_after_forgot_password"},{"location":"configuration/user-manager/#on_after_reset_password","text":"Perform logic after successful password reset. For example, you may want to send an e-mail to the concerned user to warn him that their password has been changed and that they should take action if they think they have been hacked. Arguments user ( User ): the user that reset its password. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_reset_password ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has reset their password.\" )","title":"on_after_reset_password"},{"location":"configuration/user-manager/#on_before_delete","text":"Perform logic before user delete. For example, you may want to valide user resource integrity to see if any related user resource need to be marked inactive, or delete them recursively. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_before_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is going to be deleted\" )","title":"on_before_delete"},{"location":"configuration/user-manager/#on_after_delete","text":"Perform logic after user delete. For example, you may want to send an email to the administrator about the event. Arguments user ( User ): the user to be deleted. request ( Optional[Request] ): optional FastAPI request object that triggered the operation. Defaults to None. Example from fastapi_users import BaseUserManager , UUIDIDMixin class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): # ... async def on_after_delete ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } is successfully deleted\" )","title":"on_after_delete"},{"location":"configuration/authentication/","text":"Authentication \u00b6 FastAPI Users allows you to plug in several authentication methods. How it works? \u00b6 You can have several authentication methods, e.g. a cookie authentication for browser-based queries and a JWT token authentication for pure API queries. When checking authentication, each method is run one after the other. The first method yielding a user wins. If no method yields a user, an HTTPException is raised. For each backend, you'll be able to add a router with the corresponding /login and /logout . More on this in the routers documentation . Transport + Strategy = Authentication backend \u00b6 An authentication backend is composed of two parts: Transport \u00b6 It manages how the token will be carried over the request. We currently provide two methods: Bearer \u00b6 The token will be send through an Authorization: Bearer header. Pros and cons \u2705 Easy to read and set in every requests. \u274c Needs to be stored manually somewhere in the client. \u27a1\ufe0f Use it if you want to implement a mobile application or a pure REST API. Cookie \u00b6 The token will be send through a cookie. Pros and cons \u2705 Automatically stored and sent securely by web browsers in every requests. \u2705 Automatically removed at expiration by web browsers. \u274c Needs a CSRF protection for maximum security. \u274c Harder to work with outside a browser, like a mobile app or a server. \u27a1\ufe0f Use it if you want to implement a web frontend. Strategy \u00b6 It manages how the token is generated and secured. We currently provide two methods: JWT \u00b6 The token is self-contained in a JSON Web Token. Pros and cons \u2705 Self-contained: it doesn't need to be stored in a database. \u274c Can't be invalidated on the server-side: it's valid until it expires. \u27a1\ufe0f Use it if you want to get up-and-running quickly. Database \u00b6 The token is stored in a table (or collection) in your database. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from the database. \u2705 Highly customizable: add your own fields, create an API to retrieve the active sessions of your users, etc. \u274c Configuration is a bit more complex. \u27a1\ufe0f Use it if you want maximum flexibility in your token management. Redis \u00b6 The token is stored in a Redis key-store. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from Redis. \u274c A Redis server is needed. \u27a1\ufe0f Use it if you want maximum performance while being able to invalidate tokens.","title":"Introduction"},{"location":"configuration/authentication/#authentication","text":"FastAPI Users allows you to plug in several authentication methods.","title":"Authentication"},{"location":"configuration/authentication/#how-it-works","text":"You can have several authentication methods, e.g. a cookie authentication for browser-based queries and a JWT token authentication for pure API queries. When checking authentication, each method is run one after the other. The first method yielding a user wins. If no method yields a user, an HTTPException is raised. For each backend, you'll be able to add a router with the corresponding /login and /logout . More on this in the routers documentation .","title":"How it works?"},{"location":"configuration/authentication/#transport-strategy-authentication-backend","text":"An authentication backend is composed of two parts:","title":"Transport + Strategy = Authentication backend"},{"location":"configuration/authentication/#transport","text":"It manages how the token will be carried over the request. We currently provide two methods:","title":"Transport"},{"location":"configuration/authentication/#bearer","text":"The token will be send through an Authorization: Bearer header. Pros and cons \u2705 Easy to read and set in every requests. \u274c Needs to be stored manually somewhere in the client. \u27a1\ufe0f Use it if you want to implement a mobile application or a pure REST API.","title":"Bearer"},{"location":"configuration/authentication/#cookie","text":"The token will be send through a cookie. Pros and cons \u2705 Automatically stored and sent securely by web browsers in every requests. \u2705 Automatically removed at expiration by web browsers. \u274c Needs a CSRF protection for maximum security. \u274c Harder to work with outside a browser, like a mobile app or a server. \u27a1\ufe0f Use it if you want to implement a web frontend.","title":"Cookie"},{"location":"configuration/authentication/#strategy","text":"It manages how the token is generated and secured. We currently provide two methods:","title":"Strategy"},{"location":"configuration/authentication/#jwt","text":"The token is self-contained in a JSON Web Token. Pros and cons \u2705 Self-contained: it doesn't need to be stored in a database. \u274c Can't be invalidated on the server-side: it's valid until it expires. \u27a1\ufe0f Use it if you want to get up-and-running quickly.","title":"JWT"},{"location":"configuration/authentication/#database","text":"The token is stored in a table (or collection) in your database. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from the database. \u2705 Highly customizable: add your own fields, create an API to retrieve the active sessions of your users, etc. \u274c Configuration is a bit more complex. \u27a1\ufe0f Use it if you want maximum flexibility in your token management.","title":"Database"},{"location":"configuration/authentication/#redis","text":"The token is stored in a Redis key-store. Pros and cons \u2705 Secure and performant. \u2705 Tokens can be invalidated server-side by removing them from Redis. \u274c A Redis server is needed. \u27a1\ufe0f Use it if you want maximum performance while being able to invalidate tokens.","title":"Redis"},{"location":"configuration/authentication/backend/","text":"Create a backend \u00b6 As we said, a backend is the combination of a transport and a strategy. That way, you can create a complete strategy exactly fitting your needs. For this, you have to use the AuthenticationBackend class. from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) As you can see, instantiation is quite simple. It accepts the following arguments: name ( str ): Name of the backend. Each backend should have a unique name. transport ( Transport ): An instance of a Transport class. get_strategy ( Callable[..., Strategy] ): A dependency callable returning an instance of a Strategy class. Next steps \u00b6 You can have as many authentication backends as you wish. You'll then have to pass those backends to your FastAPIUsers instance and generate an auth router for each one of them.","title":"Create a backend"},{"location":"configuration/authentication/backend/#create-a-backend","text":"As we said, a backend is the combination of a transport and a strategy. That way, you can create a complete strategy exactly fitting your needs. For this, you have to use the AuthenticationBackend class. from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) As you can see, instantiation is quite simple. It accepts the following arguments: name ( str ): Name of the backend. Each backend should have a unique name. transport ( Transport ): An instance of a Transport class. get_strategy ( Callable[..., Strategy] ): A dependency callable returning an instance of a Strategy class.","title":"Create a backend"},{"location":"configuration/authentication/backend/#next-steps","text":"You can have as many authentication backends as you wish. You'll then have to pass those backends to your FastAPIUsers instance and generate an auth router for each one of them.","title":"Next steps"},{"location":"configuration/authentication/strategies/database/","text":"Database \u00b6 The most natural way for storing tokens is of course the very same database you're using for your application. In this strategy, we set up a table (or collection) for storing those tokens with the associated user id. On each request, we try to retrive this token from the database to get the corresponding user id. Configuration \u00b6 The configuration of this strategy is a bit more complex than the others as it requires you to configure models and a database adapter, exactly like we did for users . Database adapters \u00b6 An access token will be structured like this in your database: token ( str ) \u2013 Unique identifier of the token. It's generated automatically upon login by the strategy. user_id ( ID ) \u2013 User id. of the user associated to this token. created_at ( datetime ) \u2013 Date and time of creation of the token. It's used to determine if the token is expired or not. We are providing a base model with those fields for each database we are supporting. SQLAlchemy \u00b6 We'll expand from the basic SQLAlchemy configuration. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from fastapi_users_db_sqlalchemy.access_token import ( SQLAlchemyAccessTokenDatabase , SQLAlchemyBaseAccessTokenTableUUID , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass class AccessToken ( SQLAlchemyBaseAccessTokenTableUUID , Base ): # (1)! pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) async def get_access_token_db ( session : AsyncSession = Depends ( get_async_session ), ): # (2)! yield SQLAlchemyAccessTokenDatabase ( session , AccessToken ) We define an AccessToken ORM model inheriting from SQLAlchemyBaseAccessTokenTableUUID . We define a dependency to instantiate the SQLAlchemyAccessTokenDatabase class. Just like the user database adapter, it expects a fresh SQLAlchemy session and the AccessToken model class we defined above. user_id foreign key is defined as UUID By default, we use UUID as a primary key ID for your user, so we follow the same convention to define the foreign key pointing to the user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseAccessTokenTable as base class and define your own user_id column. class AccessToken ( SQLAlchemyBaseAccessTokenTable [ int ], Base ): @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseAccessTokenTable expects a generic type to define the actual type of ID you use. Beanie \u00b6 We'll expand from the basic Beanie configuration. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase from fastapi_users_db_beanie.access_token import ( BeanieAccessTokenDatabase , BeanieBaseAccessToken , ) DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser ): pass class AccessToken ( BeanieBaseAccessToken [ PydanticObjectId ]): # (1)! pass async def get_user_db (): yield BeanieUserDatabase ( User ) async def get_access_token_db (): # (2)! yield BeanieAccessTokenDatabase ( AccessToken ) We define an AccessToken ODM model inheriting from BeanieBaseAccessToken . Notice that we set a generic type to define the type of the user_id reference. By default, it's a standard MongoDB ObjectID. We define a dependency to instantiate the BeanieAccessTokenDatabase class. Just like the user database adapter, it expects the AccessToken model class we defined above. Strategy \u00b6 import uuid from fastapi import Depends from fastapi_users.authentication.strategy.db import AccessTokenDatabase , DatabaseStrategy from .db import AccessToken , User def get_database_strategy ( access_token_db : AccessTokenDatabase [ AccessToken ] = Depends ( get_access_token_db ), ) -> DatabaseStrategy : return DatabaseStrategy ( access_token_db , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: database ( AccessTokenDatabase ): A database adapter instance for AccessToken table, like we defined above. lifetime_seconds ( int ): The lifetime of the token in seconds. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. As you can see here, this pattern allows us to dynamically inject a connection to the database. Logout \u00b6 On logout, this strategy will delete the token from the database.","title":"Database"},{"location":"configuration/authentication/strategies/database/#database","text":"The most natural way for storing tokens is of course the very same database you're using for your application. In this strategy, we set up a table (or collection) for storing those tokens with the associated user id. On each request, we try to retrive this token from the database to get the corresponding user id.","title":"Database"},{"location":"configuration/authentication/strategies/database/#configuration","text":"The configuration of this strategy is a bit more complex than the others as it requires you to configure models and a database adapter, exactly like we did for users .","title":"Configuration"},{"location":"configuration/authentication/strategies/database/#database-adapters","text":"An access token will be structured like this in your database: token ( str ) \u2013 Unique identifier of the token. It's generated automatically upon login by the strategy. user_id ( ID ) \u2013 User id. of the user associated to this token. created_at ( datetime ) \u2013 Date and time of creation of the token. It's used to determine if the token is expired or not. We are providing a base model with those fields for each database we are supporting.","title":"Database adapters"},{"location":"configuration/authentication/strategies/database/#sqlalchemy","text":"We'll expand from the basic SQLAlchemy configuration. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from fastapi_users_db_sqlalchemy.access_token import ( SQLAlchemyAccessTokenDatabase , SQLAlchemyBaseAccessTokenTableUUID , ) from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass class AccessToken ( SQLAlchemyBaseAccessTokenTableUUID , Base ): # (1)! pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) async def get_access_token_db ( session : AsyncSession = Depends ( get_async_session ), ): # (2)! yield SQLAlchemyAccessTokenDatabase ( session , AccessToken ) We define an AccessToken ORM model inheriting from SQLAlchemyBaseAccessTokenTableUUID . We define a dependency to instantiate the SQLAlchemyAccessTokenDatabase class. Just like the user database adapter, it expects a fresh SQLAlchemy session and the AccessToken model class we defined above. user_id foreign key is defined as UUID By default, we use UUID as a primary key ID for your user, so we follow the same convention to define the foreign key pointing to the user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseAccessTokenTable as base class and define your own user_id column. class AccessToken ( SQLAlchemyBaseAccessTokenTable [ int ], Base ): @declared_attr def user_id ( cls ): return Column ( Integer , ForeignKey ( \"user.id\" , ondelete = \"cascade\" ), nullable = False ) Notice that SQLAlchemyBaseAccessTokenTable expects a generic type to define the actual type of ID you use.","title":"SQLAlchemy"},{"location":"configuration/authentication/strategies/database/#beanie","text":"We'll expand from the basic Beanie configuration. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase from fastapi_users_db_beanie.access_token import ( BeanieAccessTokenDatabase , BeanieBaseAccessToken , ) DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser ): pass class AccessToken ( BeanieBaseAccessToken [ PydanticObjectId ]): # (1)! pass async def get_user_db (): yield BeanieUserDatabase ( User ) async def get_access_token_db (): # (2)! yield BeanieAccessTokenDatabase ( AccessToken ) We define an AccessToken ODM model inheriting from BeanieBaseAccessToken . Notice that we set a generic type to define the type of the user_id reference. By default, it's a standard MongoDB ObjectID. We define a dependency to instantiate the BeanieAccessTokenDatabase class. Just like the user database adapter, it expects the AccessToken model class we defined above.","title":"Beanie"},{"location":"configuration/authentication/strategies/database/#strategy","text":"import uuid from fastapi import Depends from fastapi_users.authentication.strategy.db import AccessTokenDatabase , DatabaseStrategy from .db import AccessToken , User def get_database_strategy ( access_token_db : AccessTokenDatabase [ AccessToken ] = Depends ( get_access_token_db ), ) -> DatabaseStrategy : return DatabaseStrategy ( access_token_db , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: database ( AccessTokenDatabase ): A database adapter instance for AccessToken table, like we defined above. lifetime_seconds ( int ): The lifetime of the token in seconds. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. As you can see here, this pattern allows us to dynamically inject a connection to the database.","title":"Strategy"},{"location":"configuration/authentication/strategies/database/#logout","text":"On logout, this strategy will delete the token from the database.","title":"Logout"},{"location":"configuration/authentication/strategies/jwt/","text":"JWT \u00b6 JSON Web Token (JWT) is an internet standard for creating access tokens based on JSON. They don't need to be stored in a database: the data is self-contained inside and cryptographically signed. Configuration \u00b6 from fastapi_users.authentication import JWTStrategy SECRET = \"SECRET\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: secret ( Union[str, pydantic.SecretStr] ): A constant secret which is used to encode the token. Use a strong passphrase and keep it secure. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Can be set to None but in this case the token will be valid forever ; which may raise serious security concerns. token_audience ( Optional[List[str]] ): A list of valid audiences for the JWT token. Defaults to [\"fastapi-users:auth\"] . algorithm ( Optional[str] ): The JWT encryption algorithm. See RFC 7519, section 8 . Defaults to \"HS256\" . public_key ( Optional[Union[str, pydantic.SecretStr]] ): If the JWT encryption algorithm requires a key pair instead of a simple secret, the key to decrypt the JWT may be provided here. The secret parameter will always be used to encrypt the JWT. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. For JWTStrategy , since it doesn't require dependencies, it can be as simple as the function above. RS256 example \u00b6 from fastapi_users.authentication import JWTStrategy PUBLIC_KEY = \"\"\"-----BEGIN PUBLIC KEY----- # Your RSA public key in PEM format goes here -----END PUBLIC KEY-----\"\"\" PRIVATE_KEY = \"\"\"-----BEGIN RSA PRIVATE KEY----- # Your RSA private key in PEM format goes here -----END RSA PRIVATE KEY-----\"\"\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = PRIVATE_KEY , lifetime_seconds = 3600 , algorithm = \"RS256\" , public_key = PUBLIC_KEY , ) Logout \u00b6 On logout, this strategy won't do anything . Indeed, a JWT can't be invalidated on the server-side: it's valid until it expires.","title":"JWT"},{"location":"configuration/authentication/strategies/jwt/#jwt","text":"JSON Web Token (JWT) is an internet standard for creating access tokens based on JSON. They don't need to be stored in a database: the data is self-contained inside and cryptographically signed.","title":"JWT"},{"location":"configuration/authentication/strategies/jwt/#configuration","text":"from fastapi_users.authentication import JWTStrategy SECRET = \"SECRET\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: secret ( Union[str, pydantic.SecretStr] ): A constant secret which is used to encode the token. Use a strong passphrase and keep it secure. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Can be set to None but in this case the token will be valid forever ; which may raise serious security concerns. token_audience ( Optional[List[str]] ): A list of valid audiences for the JWT token. Defaults to [\"fastapi-users:auth\"] . algorithm ( Optional[str] ): The JWT encryption algorithm. See RFC 7519, section 8 . Defaults to \"HS256\" . public_key ( Optional[Union[str, pydantic.SecretStr]] ): If the JWT encryption algorithm requires a key pair instead of a simple secret, the key to decrypt the JWT may be provided here. The secret parameter will always be used to encrypt the JWT. Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. For JWTStrategy , since it doesn't require dependencies, it can be as simple as the function above.","title":"Configuration"},{"location":"configuration/authentication/strategies/jwt/#rs256-example","text":"from fastapi_users.authentication import JWTStrategy PUBLIC_KEY = \"\"\"-----BEGIN PUBLIC KEY----- # Your RSA public key in PEM format goes here -----END PUBLIC KEY-----\"\"\" PRIVATE_KEY = \"\"\"-----BEGIN RSA PRIVATE KEY----- # Your RSA private key in PEM format goes here -----END RSA PRIVATE KEY-----\"\"\" def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = PRIVATE_KEY , lifetime_seconds = 3600 , algorithm = \"RS256\" , public_key = PUBLIC_KEY , )","title":"RS256 example"},{"location":"configuration/authentication/strategies/jwt/#logout","text":"On logout, this strategy won't do anything . Indeed, a JWT can't be invalidated on the server-side: it's valid until it expires.","title":"Logout"},{"location":"configuration/authentication/strategies/redis/","text":"Redis \u00b6 Redis is an ultra-fast key-store database. As such, it's a good candidate for token management. In this strategy, a token is generated and associated with the user id. in the database. On each request, we try to retrieve this token from Redis to get the corresponding user id. Installation \u00b6 You should install the library with the optional dependencies for Redis: pip install 'fastapi-users[redis]' Configuration \u00b6 import redis.asyncio from fastapi_users.authentication import RedisStrategy redis = redis . asyncio . from_url ( \"redis://localhost:6379\" , decode_responses = True ) def get_redis_strategy () -> RedisStrategy : return RedisStrategy ( redis , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: redis ( redis.asyncio.Redis ): An instance of redis.asyncio.Redis . Note that the decode_responses flag set to True is necessary. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Defaults to None , which means the token doesn't expire. key_prefix ( str ): The prefix used to set the key in the Redis stored. Defaults to fastapi_users_token: . Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend. Logout \u00b6 On logout, this strategy will delete the token from the Redis store.","title":"Redis"},{"location":"configuration/authentication/strategies/redis/#redis","text":"Redis is an ultra-fast key-store database. As such, it's a good candidate for token management. In this strategy, a token is generated and associated with the user id. in the database. On each request, we try to retrieve this token from Redis to get the corresponding user id.","title":"Redis"},{"location":"configuration/authentication/strategies/redis/#installation","text":"You should install the library with the optional dependencies for Redis: pip install 'fastapi-users[redis]'","title":"Installation"},{"location":"configuration/authentication/strategies/redis/#configuration","text":"import redis.asyncio from fastapi_users.authentication import RedisStrategy redis = redis . asyncio . from_url ( \"redis://localhost:6379\" , decode_responses = True ) def get_redis_strategy () -> RedisStrategy : return RedisStrategy ( redis , lifetime_seconds = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: redis ( redis.asyncio.Redis ): An instance of redis.asyncio.Redis . Note that the decode_responses flag set to True is necessary. lifetime_seconds ( Optional[int] ): The lifetime of the token in seconds. Defaults to None , which means the token doesn't expire. key_prefix ( str ): The prefix used to set the key in the Redis stored. Defaults to fastapi_users_token: . Why it's inside a function? To allow strategies to be instantiated dynamically with other dependencies, they have to be provided as a callable to the authentication backend.","title":"Configuration"},{"location":"configuration/authentication/strategies/redis/#logout","text":"On logout, this strategy will delete the token from the Redis store.","title":"Logout"},{"location":"configuration/authentication/transports/bearer/","text":"Bearer \u00b6 With this transport, the token is expected inside the Authorization header of the HTTP request with the Bearer scheme. It's particularly suited for pure API interaction or mobile apps. Configuration \u00b6 from fastapi_users.authentication import BearerTransport bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) As you can see, instantiation is quite simple. It accepts the following arguments: tokenUrl ( str ): The exact path of your login endpoint. It'll allow the interactive documentation to automatically discover it and get a working Authorize button. In most cases, you'll probably need a relative path, not absolute. You can read more details about this in the FastAPI documentation . Login \u00b6 This method will return the in the following form upon successful login: 200 OK { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Check documentation about login route . Logout \u00b6 The logout method with this transport returns nothing. Authentication \u00b6 This method expects that you provide a Bearer authentication with a valid token corresponding to your strategy. curl http://localhost:9000/protected-route -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI'","title":"Bearer"},{"location":"configuration/authentication/transports/bearer/#bearer","text":"With this transport, the token is expected inside the Authorization header of the HTTP request with the Bearer scheme. It's particularly suited for pure API interaction or mobile apps.","title":"Bearer"},{"location":"configuration/authentication/transports/bearer/#configuration","text":"from fastapi_users.authentication import BearerTransport bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) As you can see, instantiation is quite simple. It accepts the following arguments: tokenUrl ( str ): The exact path of your login endpoint. It'll allow the interactive documentation to automatically discover it and get a working Authorize button. In most cases, you'll probably need a relative path, not absolute. You can read more details about this in the FastAPI documentation .","title":"Configuration"},{"location":"configuration/authentication/transports/bearer/#login","text":"This method will return the in the following form upon successful login: 200 OK { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Check documentation about login route .","title":"Login"},{"location":"configuration/authentication/transports/bearer/#logout","text":"The logout method with this transport returns nothing.","title":"Logout"},{"location":"configuration/authentication/transports/bearer/#authentication","text":"This method expects that you provide a Bearer authentication with a valid token corresponding to your strategy. curl http://localhost:9000/protected-route -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI'","title":"Authentication"},{"location":"configuration/authentication/transports/cookie/","text":"Cookie \u00b6 Cookies are an easy way to store stateful information into the user browser. Thus, it is more useful for browser-based navigation (e.g. a front-end app making API requests) rather than pure API interaction. Configuration \u00b6 from fastapi_users.authentication import CookieTransport cookie_transport = CookieTransport ( cookie_max_age = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: cookie_name ( fastapiusersauth ): Name of the cookie. cookie_max_age ( Optional[int] ): The lifetime of the cookie in seconds. None by default, which means it's a session cookie. cookie_path ( / ): Cookie path. cookie_domain ( None ): Cookie domain. cookie_secure ( True ): Whether to only send the cookie to the server via SSL request. cookie_httponly ( True ): Whether to prevent access to the cookie via JavaScript. cookie_samesite ( lax ): A string that specifies the samesite strategy for the cookie. Valid values are lax , strict and none . Defaults to lax . Login \u00b6 This method will return a response with a valid set-cookie header upon successful login: 200 OK Check documentation about login route . Logout \u00b6 This method will remove the authentication cookie: 200 OK Check documentation about logout route . Authentication \u00b6 This method expects that you provide a valid cookie in the headers.","title":"Cookie"},{"location":"configuration/authentication/transports/cookie/#cookie","text":"Cookies are an easy way to store stateful information into the user browser. Thus, it is more useful for browser-based navigation (e.g. a front-end app making API requests) rather than pure API interaction.","title":"Cookie"},{"location":"configuration/authentication/transports/cookie/#configuration","text":"from fastapi_users.authentication import CookieTransport cookie_transport = CookieTransport ( cookie_max_age = 3600 ) As you can see, instantiation is quite simple. It accepts the following arguments: cookie_name ( fastapiusersauth ): Name of the cookie. cookie_max_age ( Optional[int] ): The lifetime of the cookie in seconds. None by default, which means it's a session cookie. cookie_path ( / ): Cookie path. cookie_domain ( None ): Cookie domain. cookie_secure ( True ): Whether to only send the cookie to the server via SSL request. cookie_httponly ( True ): Whether to prevent access to the cookie via JavaScript. cookie_samesite ( lax ): A string that specifies the samesite strategy for the cookie. Valid values are lax , strict and none . Defaults to lax .","title":"Configuration"},{"location":"configuration/authentication/transports/cookie/#login","text":"This method will return a response with a valid set-cookie header upon successful login: 200 OK Check documentation about login route .","title":"Login"},{"location":"configuration/authentication/transports/cookie/#logout","text":"This method will remove the authentication cookie: 200 OK Check documentation about logout route .","title":"Logout"},{"location":"configuration/authentication/transports/cookie/#authentication","text":"This method expects that you provide a valid cookie in the headers.","title":"Authentication"},{"location":"configuration/databases/beanie/","text":"Beanie \u00b6 FastAPI Users provides the necessary tools to work with MongoDB databases using the Beanie ODM . Setup database connection and collection \u00b6 The first thing to do is to create a MongoDB connection using mongodb/motor (automatically installed with Beanie). import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) You can choose any name for the database. Create the User model \u00b6 As for any Beanie ODM model, we'll create a User model. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Document ID is a MongoDB ObjectID Beanie automatically manages document ID by encoding/decoding MongoDB ObjectID. If you want to use another type, like UUID, you can override the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Notice that BeanieBaseUser expects a generic type to define the actual type of ID you use. Info The base class is configured to automatically create a unique index on id and email . Create the database adapter \u00b6 The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) Notice that we pass a reference to the User model we defined above. Initialize Beanie \u00b6 When initializing your FastAPI app, it's important that you initialize Beanie so it can discover your models. We can achieve this using a startup event handler on the FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , # (1)! document_models = [ User , # (2)! ], ) This is the db Motor database instance we defined above. This is the Beanie User model we defined above. Don't forget to also add your very own models!","title":"Beanie"},{"location":"configuration/databases/beanie/#beanie","text":"FastAPI Users provides the necessary tools to work with MongoDB databases using the Beanie ODM .","title":"Beanie"},{"location":"configuration/databases/beanie/#setup-database-connection-and-collection","text":"The first thing to do is to create a MongoDB connection using mongodb/motor (automatically installed with Beanie). import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) You can choose any name for the database.","title":"Setup database connection and collection"},{"location":"configuration/databases/beanie/#create-the-user-model","text":"As for any Beanie ODM model, we'll create a User model. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Document ID is a MongoDB ObjectID Beanie automatically manages document ID by encoding/decoding MongoDB ObjectID. If you want to use another type, like UUID, you can override the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Notice that BeanieBaseUser expects a generic type to define the actual type of ID you use. Info The base class is configured to automatically create a unique index on id and email .","title":"Create the User model"},{"location":"configuration/databases/beanie/#create-the-database-adapter","text":"The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) Notice that we pass a reference to the User model we defined above.","title":"Create the database adapter"},{"location":"configuration/databases/beanie/#initialize-beanie","text":"When initializing your FastAPI app, it's important that you initialize Beanie so it can discover your models. We can achieve this using a startup event handler on the FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , # (1)! document_models = [ User , # (2)! ], ) This is the db Motor database instance we defined above. This is the Beanie User model we defined above. Don't forget to also add your very own models!","title":"Initialize Beanie"},{"location":"configuration/databases/sqlalchemy/","text":"SQLAlchemy \u00b6 FastAPI Users provides the necessary tools to work with SQL databases thanks to SQLAlchemy ORM with asyncio . Asynchronous driver \u00b6 To work with your DBMS, you'll need to install the corresponding asyncio driver. The common choices are: For PostgreSQL: pip install asyncpg For SQLite: pip install aiosqlite Examples of DB_URL s are: PostgreSQL: engine = create_engine('postgresql+asyncpg://user:password@host:port/name') SQLite: engine = create_engine('sqlite+aiosqlite:///name.db') For the sake of this tutorial from now on, we'll use a simple SQLite database. Create the User model \u00b6 As for any SQLAlchemy ORM model, we'll create a User model. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseUserTable as base class and define your own id column. class User ( SQLAlchemyBaseUserTable [ int ], Base ): id = Column ( Integer , primary_key = True ) Notice that SQLAlchemyBaseUserTable expects a generic type to define the actual type of ID you use. Implement a function to create the tables \u00b6 We'll now create an utility function to create all the defined tables. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) This function can be called, for example, during the initialization of your FastAPI app. Warning In production, it's strongly recommended to setup a migration system to update your SQL schemas. See Alembic . Create the database adapter dependency \u00b6 The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) Notice that we define first a get_async_session dependency returning us a fresh SQLAlchemy session to interact with the database. It's then used inside the get_user_db dependency to generate our adapter. Notice that we pass it two things: The session instance we just injected. The User class, which is the actual SQLAlchemy model.","title":"SQLAlchemy"},{"location":"configuration/databases/sqlalchemy/#sqlalchemy","text":"FastAPI Users provides the necessary tools to work with SQL databases thanks to SQLAlchemy ORM with asyncio .","title":"SQLAlchemy"},{"location":"configuration/databases/sqlalchemy/#asynchronous-driver","text":"To work with your DBMS, you'll need to install the corresponding asyncio driver. The common choices are: For PostgreSQL: pip install asyncpg For SQLite: pip install aiosqlite Examples of DB_URL s are: PostgreSQL: engine = create_engine('postgresql+asyncpg://user:password@host:port/name') SQLite: engine = create_engine('sqlite+aiosqlite:///name.db') For the sake of this tutorial from now on, we'll use a simple SQLite database.","title":"Asynchronous driver"},{"location":"configuration/databases/sqlalchemy/#create-the-user-model","text":"As for any SQLAlchemy ORM model, we'll create a User model. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) As you can see, FastAPI Users provides a base class that will include base fields for our User table. You can of course add you own fields there to fit to your needs! Primary key is defined as UUID By default, we use UUID as a primary key ID for your user. If you want to use another type, like an auto-incremented integer, you can use SQLAlchemyBaseUserTable as base class and define your own id column. class User ( SQLAlchemyBaseUserTable [ int ], Base ): id = Column ( Integer , primary_key = True ) Notice that SQLAlchemyBaseUserTable expects a generic type to define the actual type of ID you use.","title":"Create the User model"},{"location":"configuration/databases/sqlalchemy/#implement-a-function-to-create-the-tables","text":"We'll now create an utility function to create all the defined tables. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) This function can be called, for example, during the initialization of your FastAPI app. Warning In production, it's strongly recommended to setup a migration system to update your SQL schemas. See Alembic .","title":"Implement a function to create the tables"},{"location":"configuration/databases/sqlalchemy/#create-the-database-adapter-dependency","text":"The database adapter of FastAPI Users makes the link between your database configuration and the users logic. It should be generated by a FastAPI dependency. from typing import AsyncGenerator from fastapi import Depends from fastapi_users.db import SQLAlchemyBaseUserTableUUID , SQLAlchemyUserDatabase from sqlalchemy.ext.asyncio import AsyncSession , create_async_engine from sqlalchemy.ext.declarative import DeclarativeMeta , declarative_base from sqlalchemy.orm import sessionmaker DATABASE_URL = \"sqlite+aiosqlite:///./test.db\" Base : DeclarativeMeta = declarative_base () class User ( SQLAlchemyBaseUserTableUUID , Base ): pass engine = create_async_engine ( DATABASE_URL ) async_session_maker = sessionmaker ( engine , class_ = AsyncSession , expire_on_commit = False ) async def create_db_and_tables (): async with engine . begin () as conn : await conn . run_sync ( Base . metadata . create_all ) async def get_async_session () -> AsyncGenerator [ AsyncSession , None ]: async with async_session_maker () as session : yield session async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) Notice that we define first a get_async_session dependency returning us a fresh SQLAlchemy session to interact with the database. It's then used inside the get_user_db dependency to generate our adapter. Notice that we pass it two things: The session instance we just injected. The User class, which is the actual SQLAlchemy model.","title":"Create the database adapter dependency"},{"location":"configuration/routers/","text":"Routers \u00b6 We're almost there! The last step is to configure the FastAPIUsers object that will wire the user manager, the authentication classes and let us generate the actual API routes . Configure FastAPIUsers \u00b6 Configure FastAPIUsers object with the elements we defined before. More precisely: get_user_manager : Dependency callable getter to inject the user manager class instance. See UserManager . auth_backends : List of authentication backends. See Authentication . import uuid from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) Typing: User and ID generic types are expected You can see that we define two generic types when instantiating: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion . Available routers \u00b6 This helper class will let you generate useful routers to setup the authentication system. Each of them is optional , so you can pick only the one that you are interested in! Here are the routers provided: Auth router : Provides /login and /logout routes for a given authentication backend . Register router : Provides /register routes to allow a user to create a new account. Reset password router : Provides /forgot-password and /reset-password routes to allow a user to reset its password. Verify router : Provides /request-verify-token and /verify routes to manage user e-mail verification. Users router : Provides routes to manage users. OAuth router : Provides routes to perform an OAuth authentication against a service provider (like Google or Facebook). You should check out each of them to understand how to use them.","title":"Introduction"},{"location":"configuration/routers/#routers","text":"We're almost there! The last step is to configure the FastAPIUsers object that will wire the user manager, the authentication classes and let us generate the actual API routes .","title":"Routers"},{"location":"configuration/routers/#configure-fastapiusers","text":"Configure FastAPIUsers object with the elements we defined before. More precisely: get_user_manager : Dependency callable getter to inject the user manager class instance. See UserManager . auth_backends : List of authentication backends. See Authentication . import uuid from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) Typing: User and ID generic types are expected You can see that we define two generic types when instantiating: User , which is the user model we defined in the database part The ID, which should correspond to the type of ID you use on your model. Here, we chose UUID, but it can be anything, like an integer or a MongoDB ObjectID. It'll help you to have good type-checking and auto-completion .","title":"Configure FastAPIUsers"},{"location":"configuration/routers/#available-routers","text":"This helper class will let you generate useful routers to setup the authentication system. Each of them is optional , so you can pick only the one that you are interested in! Here are the routers provided: Auth router : Provides /login and /logout routes for a given authentication backend . Register router : Provides /register routes to allow a user to create a new account. Reset password router : Provides /forgot-password and /reset-password routes to allow a user to reset its password. Verify router : Provides /request-verify-token and /verify routes to manage user e-mail verification. Users router : Provides routes to manage users. OAuth router : Provides routes to perform an OAuth authentication against a service provider (like Google or Facebook). You should check out each of them to understand how to use them.","title":"Available routers"},{"location":"configuration/routers/auth/","text":"Auth router \u00b6 The auth router will generate /login and /logout routes for a given authentication backend . Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], ) Optional: user verification \u00b6 You can require the user to be verified (i.e. is_verified property set to True ) to allow login. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_auth_router ( auth_backend , requires_verification = True ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], )","title":"Auth router"},{"location":"configuration/routers/auth/#auth-router","text":"The auth router will generate /login and /logout routes for a given authentication backend . Check the routes usage to learn how to use them.","title":"Auth router"},{"location":"configuration/routers/auth/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"configuration/routers/auth/#optional-user-verification","text":"You can require the user to be verified (i.e. is_verified property set to True ) to allow login. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_auth_router ( auth_backend , requires_verification = True ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ], )","title":"Optional: user verification"},{"location":"configuration/routers/register/","text":"Register routes \u00b6 The register router will generate a /register route to allow a user to create a new account. Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserCreate , UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Register routes"},{"location":"configuration/routers/register/#register-routes","text":"The register router will generate a /register route to allow a user to create a new account. Check the routes usage to learn how to use them.","title":"Register routes"},{"location":"configuration/routers/register/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserCreate , UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"configuration/routers/reset/","text":"Reset password router \u00b6 The reset password router will generate /forgot-password (the user asks for a token to reset its password) and /reset-password (the user changes its password given the token) routes. Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Reset password router"},{"location":"configuration/routers/reset/#reset-password-router","text":"The reset password router will generate /forgot-password (the user asks for a token to reset its password) and /reset-password (the user changes its password given the token) routes. Check the routes usage to learn how to use them.","title":"Reset password router"},{"location":"configuration/routers/reset/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"configuration/routers/users/","text":"Users router \u00b6 This router provides routes to manage users. Check the routes usage to learn how to use them. Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead , UserUpdate fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) Optional: user verification \u00b6 You can require the user to be verified (i.e. is_verified property set to True ) to access those routes. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate , requires_verification = True ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"Users router"},{"location":"configuration/routers/users/#users-router","text":"This router provides routes to manage users. Check the routes usage to learn how to use them.","title":"Users router"},{"location":"configuration/routers/users/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead , UserUpdate fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"Setup"},{"location":"configuration/routers/users/#optional-user-verification","text":"You can require the user to be verified (i.e. is_verified property set to True ) to access those routes. You have to set the requires_verification parameter to True on the router instantiation method: app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate , requires_verification = True ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"Optional: user verification"},{"location":"configuration/routers/verify/","text":"Verify router \u00b6 This router provides routes to manage user email verification. Check the routes usage to learn how to use them. \ud83d\udc4f\ud83d\udc4f\ud83d\udc4f A big thank you to Edd Salkield and Mark Todd who worked hard on this feature! Setup \u00b6 import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Verify router"},{"location":"configuration/routers/verify/#verify-router","text":"This router provides routes to manage user email verification. Check the routes usage to learn how to use them. \ud83d\udc4f\ud83d\udc4f\ud83d\udc4f A big thank you to Edd Salkield and Mark Todd who worked hard on this feature!","title":"Verify router"},{"location":"configuration/routers/verify/#setup","text":"import uuid from fastapi import FastAPI from fastapi_users import FastAPIUsers from .db import User from .schemas import UserRead fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) app = FastAPI () app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], )","title":"Setup"},{"location":"cookbook/create-user-programmatically/","text":"Create a user programmatically \u00b6 Sometimes, you'll need to create a user programmatically in the code rather than passing by the REST API endpoint. To do this, we'll create a function that you can call from your code. In this context, we are outside the dependency injection mechanism of FastAPI, so we have to take care of instantiating the UserManager class and all other dependent objects manually . For this cookbook, we'll consider you are starting from the SQLAlchemy full example , but it'll be rather similar for other DBMS. 1. Define dependencies as context managers \u00b6 Generally, FastAPI dependencies are defined as generators , using the yield keyword. FastAPI knows very well to handle them inside its dependency injection system. For example, here is the definition of the get_user_manager dependency: async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) In Python, when we want to use a generator, we have to use a for loop, which would be a bit unnatural in this context since we have only one value to get, the user manager instance. To avoid this, we'll transform them into context managers , so we can call them using the with..as syntax. Fortunately, the standard library provides tools to automatically transform generators into context managers. In the following sample, we import our dependencies and create a context manager version using contextlib.asynccontextmanager : import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" ) I have other dependencies Since FastAPI Users fully embraces dependency injection, you may have more arguments passed to your database or user manager dependencies. It's important then to not forget anyone. Once again, outside the dependency injection system, you are responsible of instantiating everything yourself. 2. Write a function \u00b6 We are now ready to write a function. The example below shows you a basic example but you can of course adapt it to your own needs. The key part here is once again to take care of opening every context managers and pass them every required arguments , as the dependency manager would do. import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" ) 3. Use it \u00b6 You can now easily use it in a script. For example: import asyncio if __name__ == \"__main__\" : asyncio . run ( create_user ( \"king.arthur@camelot.bt\" , \"guinevere\" ))","title":"Create a user programmatically"},{"location":"cookbook/create-user-programmatically/#create-a-user-programmatically","text":"Sometimes, you'll need to create a user programmatically in the code rather than passing by the REST API endpoint. To do this, we'll create a function that you can call from your code. In this context, we are outside the dependency injection mechanism of FastAPI, so we have to take care of instantiating the UserManager class and all other dependent objects manually . For this cookbook, we'll consider you are starting from the SQLAlchemy full example , but it'll be rather similar for other DBMS.","title":"Create a user programmatically"},{"location":"cookbook/create-user-programmatically/#1-define-dependencies-as-context-managers","text":"Generally, FastAPI dependencies are defined as generators , using the yield keyword. FastAPI knows very well to handle them inside its dependency injection system. For example, here is the definition of the get_user_manager dependency: async def get_user_manager ( user_db : SQLAlchemyUserDatabase = Depends ( get_user_db )): yield UserManager ( user_db ) In Python, when we want to use a generator, we have to use a for loop, which would be a bit unnatural in this context since we have only one value to get, the user manager instance. To avoid this, we'll transform them into context managers , so we can call them using the with..as syntax. Fortunately, the standard library provides tools to automatically transform generators into context managers. In the following sample, we import our dependencies and create a context manager version using contextlib.asynccontextmanager : import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" ) I have other dependencies Since FastAPI Users fully embraces dependency injection, you may have more arguments passed to your database or user manager dependencies. It's important then to not forget anyone. Once again, outside the dependency injection system, you are responsible of instantiating everything yourself.","title":"1. Define dependencies as context managers"},{"location":"cookbook/create-user-programmatically/#2-write-a-function","text":"We are now ready to write a function. The example below shows you a basic example but you can of course adapt it to your own needs. The key part here is once again to take care of opening every context managers and pass them every required arguments , as the dependency manager would do. import contextlib from app.db import get_async_session , get_user_db from app.schemas import UserCreate from app.users import get_user_manager from fastapi_users.exceptions import UserAlreadyExists get_async_session_context = contextlib . asynccontextmanager ( get_async_session ) get_user_db_context = contextlib . asynccontextmanager ( get_user_db ) get_user_manager_context = contextlib . asynccontextmanager ( get_user_manager ) async def create_user ( email : str , password : str , is_superuser : bool = False ): try : async with get_async_session_context () as session : async with get_user_db_context ( session ) as user_db : async with get_user_manager_context ( user_db ) as user_manager : user = await user_manager . create ( UserCreate ( email = email , password = password , is_superuser = is_superuser ) ) print ( f \"User created { user } \" ) except UserAlreadyExists : print ( f \"User { email } already exists\" )","title":"2. Write a function"},{"location":"cookbook/create-user-programmatically/#3-use-it","text":"You can now easily use it in a script. For example: import asyncio if __name__ == \"__main__\" : asyncio . run ( create_user ( \"king.arthur@camelot.bt\" , \"guinevere\" ))","title":"3. Use it"},{"location":"migration/08_to_1x/","text":"0.8.x \u27a1\ufe0f 1.x.x \u00b6 1.0 version introduces major breaking changes that need you to update some of your code and migrate your data. Id. are UUID \u00b6 Users and OAuth accounts id. are now represented as real UUID objects instead of plain strings. This change was introduced to leverage efficient storage and indexing for DBMS that supports UUID (especially PostgreSQL and Mongo). In Python code \u00b6 If you were doing comparison betwen a user id. and a string (in unit tests for example), you should now cast the id. to string: # Before assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == user . id # Now assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == str ( user . id ) If you were refering to user id. in your Pydantic models, the field should now be of UUID4 type instead of str : from pydantic import BaseModel , UUID4 # Before class Model ( BaseModel ): user_id : str # After class Model ( BaseModel ): user_id : UUID4 MongoDB \u00b6 To avoid any issues, it's recommended to use the standard UUID representation when instantiating the MongoDB client: DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) This parameter controls how the UUID values will be encoded in the database. By default, it's set to pythonLegacy but new applications should consider setting this to standard for cross language compatibility. Read more about this . In database \u00b6 Id. were before stored as strings in the database. You should make a migration to convert string data to UUID data. Danger Scripts below are provided as guidelines. Please review them carefully , adapt them and check that they are working on a test database before applying them to production. BE CAREFUL. THEY CAN DESTROY YOUR DATA. . PostgreSQL \u00b6 PostgreSQL supports UUID type. If not already, you should enable the uuid-ossp extension: CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\" ; To convert the existing id. string column, we can: Create a new column with UUID type. Fill it with the id. converted to UUID. Drop the original id. column. Make the new column a primary key and rename it. ALTER TABLE \"user\" ADD uuid_id UUID ; UPDATE \"user\" SET uuid_id = uuid ( id ); ALTER TABLE \"user\" DROP id ; ALTER TABLE \"user\" ADD PRIMARY KEY ( uuid_id ); ALTER TABLE \"user\" RENAME COLUMN uuid_id TO id ; MySQL \u00b6 MySQL doesn't support UUID type. We'll just convert the column to CHAR(36) type: ALTER TABLE \"user\" MODIFY id CHAR ( 36 ); MongoDB \u00b6 Mongo shell \u00b6 For MongoDB, we can use a forEach iterator to convert the id. for each document: db . getCollection ( 'users' ). find (). forEach ( function ( user ) { var uuid = UUID ( user . id ); db . getCollection ( 'users' ). update ({ _id : user . _id }, [{ $set : { id : uuid }}]); }); Python \u00b6 import uuid import motor.motor_asyncio async def migrate_uuid (): client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] users = db [ \"users\" ] async for user in users . find ({}): await users . update_one ( { \"_id\" : user [ \"_id\" ]}, { \"$set\" : { \"id\" : uuid . UUID ( user [ \"id\" ])}}, ) Splitted routers \u00b6 You now have the responsibility to wire the routers . FastAPI Users doesn't give a bloated users router anymore. Event handlers are also removed. You have to provide your \"after-\" logic as a parameter of the router generator. Before \u00b6 jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . router , prefix = \"/users\" , tags = [ \"users\" ]) @fastapi_users . on_after_register () def on_after_register ( user : User , request : Request ): print ( f \"User { user . id } has registered.\" ) @fastapi_users . on_after_forgot_password () def on_after_forgot_password ( user : User , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) After \u00b6 def on_after_register ( user : UserDB , request : Request ): print ( f \"User { user . id } has registered.\" ) def on_after_forgot_password ( user : UserDB , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . get_auth_router ( jwt_authentication ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( on_after_register ), prefix = \"/auth\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_reset_password_router ( SECRET , after_forgot_password = on_after_forgot_password ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) Important things to notice: FastAPIUsers takes two arguments less ( reset_password_token_secret and reset_password_token_lifetime_seconds ). You have more flexibility to choose the prefix and tags of the routers. The /login / /logout are now your responsibility to include for each backend. The path will change (before /login/jwt , after /jwt/login ). If you don't care about some of those routers, you can discard them.","title":"0.8.x \u27a1\ufe0f 1.x.x"},{"location":"migration/08_to_1x/#08x-1xx","text":"1.0 version introduces major breaking changes that need you to update some of your code and migrate your data.","title":"0.8.x \u27a1\ufe0f 1.x.x"},{"location":"migration/08_to_1x/#id-are-uuid","text":"Users and OAuth accounts id. are now represented as real UUID objects instead of plain strings. This change was introduced to leverage efficient storage and indexing for DBMS that supports UUID (especially PostgreSQL and Mongo).","title":"Id. are UUID"},{"location":"migration/08_to_1x/#in-python-code","text":"If you were doing comparison betwen a user id. and a string (in unit tests for example), you should now cast the id. to string: # Before assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == user . id # Now assert \"d35d213e-f3d8-4f08-954a-7e0d1bea286f\" == str ( user . id ) If you were refering to user id. in your Pydantic models, the field should now be of UUID4 type instead of str : from pydantic import BaseModel , UUID4 # Before class Model ( BaseModel ): user_id : str # After class Model ( BaseModel ): user_id : UUID4","title":"In Python code"},{"location":"migration/08_to_1x/#mongodb","text":"To avoid any issues, it's recommended to use the standard UUID representation when instantiating the MongoDB client: DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) This parameter controls how the UUID values will be encoded in the database. By default, it's set to pythonLegacy but new applications should consider setting this to standard for cross language compatibility. Read more about this .","title":"MongoDB"},{"location":"migration/08_to_1x/#in-database","text":"Id. were before stored as strings in the database. You should make a migration to convert string data to UUID data. Danger Scripts below are provided as guidelines. Please review them carefully , adapt them and check that they are working on a test database before applying them to production. BE CAREFUL. THEY CAN DESTROY YOUR DATA. .","title":"In database"},{"location":"migration/08_to_1x/#postgresql","text":"PostgreSQL supports UUID type. If not already, you should enable the uuid-ossp extension: CREATE EXTENSION IF NOT EXISTS \"uuid-ossp\" ; To convert the existing id. string column, we can: Create a new column with UUID type. Fill it with the id. converted to UUID. Drop the original id. column. Make the new column a primary key and rename it. ALTER TABLE \"user\" ADD uuid_id UUID ; UPDATE \"user\" SET uuid_id = uuid ( id ); ALTER TABLE \"user\" DROP id ; ALTER TABLE \"user\" ADD PRIMARY KEY ( uuid_id ); ALTER TABLE \"user\" RENAME COLUMN uuid_id TO id ;","title":"PostgreSQL"},{"location":"migration/08_to_1x/#mysql","text":"MySQL doesn't support UUID type. We'll just convert the column to CHAR(36) type: ALTER TABLE \"user\" MODIFY id CHAR ( 36 );","title":"MySQL"},{"location":"migration/08_to_1x/#mongodb_1","text":"","title":"MongoDB"},{"location":"migration/08_to_1x/#mongo-shell","text":"For MongoDB, we can use a forEach iterator to convert the id. for each document: db . getCollection ( 'users' ). find (). forEach ( function ( user ) { var uuid = UUID ( user . id ); db . getCollection ( 'users' ). update ({ _id : user . _id }, [{ $set : { id : uuid }}]); });","title":"Mongo shell"},{"location":"migration/08_to_1x/#python","text":"import uuid import motor.motor_asyncio async def migrate_uuid (): client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] users = db [ \"users\" ] async for user in users . find ({}): await users . update_one ( { \"_id\" : user [ \"_id\" ]}, { \"$set\" : { \"id\" : uuid . UUID ( user [ \"id\" ])}}, )","title":"Python"},{"location":"migration/08_to_1x/#splitted-routers","text":"You now have the responsibility to wire the routers . FastAPI Users doesn't give a bloated users router anymore. Event handlers are also removed. You have to provide your \"after-\" logic as a parameter of the router generator.","title":"Splitted routers"},{"location":"migration/08_to_1x/#before","text":"jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . router , prefix = \"/users\" , tags = [ \"users\" ]) @fastapi_users . on_after_register () def on_after_register ( user : User , request : Request ): print ( f \"User { user . id } has registered.\" ) @fastapi_users . on_after_forgot_password () def on_after_forgot_password ( user : User , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" )","title":"Before"},{"location":"migration/08_to_1x/#after","text":"def on_after_register ( user : UserDB , request : Request ): print ( f \"User { user . id } has registered.\" ) def on_after_forgot_password ( user : UserDB , token : str , request : Request ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) app = FastAPI () fastapi_users = FastAPIUsers ( user_db , [ jwt_authentication ], User , UserCreate , UserUpdate , UserDB , ) app . include_router ( fastapi_users . get_auth_router ( jwt_authentication ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( on_after_register ), prefix = \"/auth\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_reset_password_router ( SECRET , after_forgot_password = on_after_forgot_password ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) Important things to notice: FastAPIUsers takes two arguments less ( reset_password_token_secret and reset_password_token_lifetime_seconds ). You have more flexibility to choose the prefix and tags of the routers. The /login / /logout are now your responsibility to include for each backend. The path will change (before /login/jwt , after /jwt/login ). If you don't care about some of those routers, you can discard them.","title":"After"},{"location":"migration/1x_to_2x/","text":"1.x.x \u27a1\ufe0f 2.x.x \u00b6 JWT authentication backend \u00b6 To be fully compatible with Swagger authentication, the output of a successful login operation with the JWT authentication backend has changed: Before { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } After { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Make sure to update your clients to read the token in the right property.","title":"1.x.x \u27a1\ufe0f 2.x.x"},{"location":"migration/1x_to_2x/#1xx-2xx","text":"","title":"1.x.x \u27a1\ufe0f 2.x.x"},{"location":"migration/1x_to_2x/#jwt-authentication-backend","text":"To be fully compatible with Swagger authentication, the output of a successful login operation with the JWT authentication backend has changed: Before { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } After { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"token_type\" : \"bearer\" } Make sure to update your clients to read the token in the right property.","title":"JWT authentication backend"},{"location":"migration/2x_to_3x/","text":"2.x.x \u27a1\ufe0f 3.x.x \u00b6 Emails are now case-insensitive \u00b6 Before 3.x.x, the local part (before the @) of the email address was case-sensitive. Therefore, king.arthur@camelot.bt and King.Arthur@camelot.bt were considered as two different users . This behaviour was a bit confusing and not consistent with 99% of web services out there. After 3.x.x, users are fetched from the database with a case-insensitive email search. Bear in mind though that if the user registers with the email King.Arthur@camelot.bt , it will be stored exactly like this in the database (with casing) ; but he will be able to login as king.arthur@camelot.bt . Danger It's super important then, before you upgrade to 3.x.x that you check if there are several users with the same email with different cases ; and that you merge or delete those accounts .","title":"2.x.x \u27a1\ufe0f 3.x.x"},{"location":"migration/2x_to_3x/#2xx-3xx","text":"","title":"2.x.x \u27a1\ufe0f 3.x.x"},{"location":"migration/2x_to_3x/#emails-are-now-case-insensitive","text":"Before 3.x.x, the local part (before the @) of the email address was case-sensitive. Therefore, king.arthur@camelot.bt and King.Arthur@camelot.bt were considered as two different users . This behaviour was a bit confusing and not consistent with 99% of web services out there. After 3.x.x, users are fetched from the database with a case-insensitive email search. Bear in mind though that if the user registers with the email King.Arthur@camelot.bt , it will be stored exactly like this in the database (with casing) ; but he will be able to login as king.arthur@camelot.bt . Danger It's super important then, before you upgrade to 3.x.x that you check if there are several users with the same email with different cases ; and that you merge or delete those accounts .","title":"Emails are now case-insensitive"},{"location":"migration/3x_to_4x/","text":"3.x.x \u27a1\ufe0f 4.x.x \u00b6 expires_at property in OAuthAccount is now optional \u00b6 Before 4.x.x, the expires_at property in OAuthAccount model was mandatory. It was causing issues with some services that don't have such expiration property. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"3.x.x \u27a1\ufe0f 4.x.x"},{"location":"migration/3x_to_4x/#3xx-4xx","text":"","title":"3.x.x \u27a1\ufe0f 4.x.x"},{"location":"migration/3x_to_4x/#expires_at-property-in-oauthaccount-is-now-optional","text":"Before 4.x.x, the expires_at property in OAuthAccount model was mandatory. It was causing issues with some services that don't have such expiration property. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"expires_at property in OAuthAccount is now optional"},{"location":"migration/4x_to_5x/","text":"4.x.x \u27a1\ufe0f 5.x.x \u00b6 New property is_verified in User model. \u00b6 Starting 5.x.x., there is a new e-mail verification feature . Even if optional, the is_verified property has been added to the User model. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"4.x.x \u27a1\ufe0f 5.x.x"},{"location":"migration/4x_to_5x/#4xx-5xx","text":"","title":"4.x.x \u27a1\ufe0f 5.x.x"},{"location":"migration/4x_to_5x/#new-property-is_verified-in-user-model","text":"Starting 5.x.x., there is a new e-mail verification feature . Even if optional, the is_verified property has been added to the User model. If you use SQLAlchemy or Tortoise databases adapters, you'll have to make a migration to update your database schema.","title":"New property is_verified in User model."},{"location":"migration/6x_to_7x/","text":"6.x.x \u27a1\ufe0f 7.x.x \u00b6 The deprecated dependencies to retrieve current user have been removed. Use the current_user factory instead. [ Documentation ] When trying to authenticate a not verified user, a status code 403 is raised instead of status code 401. Thanks @daanbeverdam \ud83c\udf89 [ Documentation ] Your UserUpdate model shouldn't inherit from the base User class. If you have custom fields, you should repeat them in this model. [ Documentation ] Database adapters now live in their own repositories and packages . When upgrading to v7.0.0, the dependency for your database adapter should automatically be installed. The import statements remain unchanged.","title":"6.x.x \u27a1\ufe0f 7.x.x"},{"location":"migration/6x_to_7x/#6xx-7xx","text":"The deprecated dependencies to retrieve current user have been removed. Use the current_user factory instead. [ Documentation ] When trying to authenticate a not verified user, a status code 403 is raised instead of status code 401. Thanks @daanbeverdam \ud83c\udf89 [ Documentation ] Your UserUpdate model shouldn't inherit from the base User class. If you have custom fields, you should repeat them in this model. [ Documentation ] Database adapters now live in their own repositories and packages . When upgrading to v7.0.0, the dependency for your database adapter should automatically be installed. The import statements remain unchanged.","title":"6.x.x \u27a1\ufe0f 7.x.x"},{"location":"migration/7x_to_8x/","text":"7.x.x \u27a1\ufe0f 8.x.x \u00b6 Version 8 includes the biggest code changes since version 1. We reorganized lot of parts of the code to make it even more modular and integrate more into the dependency injection system of FastAPI. Most importantly, you need now to implement a UserManager class and a associated dependency to create an instance of this class. Event handlers should live in the UserManager \u00b6 Before, event handlers like on_after_register or on_after_forgot_password were defined in their own functions that were passed as arguments of router generators. Now, they should be methods of the UserManager class. You can read more in the UserManager documentation . Password validation should live in the UserManager \u00b6 Before, password validation was defined in its own function that was passed as argument of FastAPIUsers . Now, it should be a method of the UserManager class. You can read more in the UserManager documentation . Verify token secret and lifetime parameters are attributes of UserManager \u00b6 Before, verify token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation . Reset password token secret and lifetime parameters are attributes of UserManager \u00b6 Before, reset password token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation . Database adapter should be provided in a dependency \u00b6 Before, we advised to directly instantiate the database adapter class. Now, it should be instantiated inside a dependency that you define yourself. The benefit of this is that it lives in the dependency injection system of FastAPI, allowing you to have more dynamic logic to create your instance. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using MongoDB \u27a1\ufe0f I'm using Tortoise ORM \u27a1\ufe0f I'm using ormar FastAPIUsers now expect a get_user_manager dependency \u00b6 Before, the database adapter instance was passed as argument of FastAPIUsers . Now, you should define a get_user_manager dependency returning an instance of your UserManager class. This dependency will be dependent of the database adapter dependency. You can read more in the UserManager documentation and FastAPIUsers documentation Lost? \u00b6 If you're unsure or a bit lost, make sure to check the full working examples .","title":"7.x.x \u27a1\ufe0f 8.x.x"},{"location":"migration/7x_to_8x/#7xx-8xx","text":"Version 8 includes the biggest code changes since version 1. We reorganized lot of parts of the code to make it even more modular and integrate more into the dependency injection system of FastAPI. Most importantly, you need now to implement a UserManager class and a associated dependency to create an instance of this class.","title":"7.x.x \u27a1\ufe0f 8.x.x"},{"location":"migration/7x_to_8x/#event-handlers-should-live-in-the-usermanager","text":"Before, event handlers like on_after_register or on_after_forgot_password were defined in their own functions that were passed as arguments of router generators. Now, they should be methods of the UserManager class. You can read more in the UserManager documentation .","title":"Event handlers should live in the UserManager"},{"location":"migration/7x_to_8x/#password-validation-should-live-in-the-usermanager","text":"Before, password validation was defined in its own function that was passed as argument of FastAPIUsers . Now, it should be a method of the UserManager class. You can read more in the UserManager documentation .","title":"Password validation should live in the UserManager"},{"location":"migration/7x_to_8x/#verify-token-secret-and-lifetime-parameters-are-attributes-of-usermanager","text":"Before, verify token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation .","title":"Verify token secret and lifetime parameters are attributes of UserManager"},{"location":"migration/7x_to_8x/#reset-password-token-secret-and-lifetime-parameters-are-attributes-of-usermanager","text":"Before, reset password token and lifetime parameters were passed as argument of get_verify_router . Now, they should be defined as attributes of the UserManager class. You can read more in the UserManager documentation .","title":"Reset password token secret and lifetime parameters are attributes of UserManager"},{"location":"migration/7x_to_8x/#database-adapter-should-be-provided-in-a-dependency","text":"Before, we advised to directly instantiate the database adapter class. Now, it should be instantiated inside a dependency that you define yourself. The benefit of this is that it lives in the dependency injection system of FastAPI, allowing you to have more dynamic logic to create your instance. \u27a1\ufe0f I'm using SQLAlchemy \u27a1\ufe0f I'm using MongoDB \u27a1\ufe0f I'm using Tortoise ORM \u27a1\ufe0f I'm using ormar","title":"Database adapter should be provided in a dependency"},{"location":"migration/7x_to_8x/#fastapiusers-now-expect-a-get_user_manager-dependency","text":"Before, the database adapter instance was passed as argument of FastAPIUsers . Now, you should define a get_user_manager dependency returning an instance of your UserManager class. This dependency will be dependent of the database adapter dependency. You can read more in the UserManager documentation and FastAPIUsers documentation","title":"FastAPIUsers now expect a get_user_manager dependency"},{"location":"migration/7x_to_8x/#lost","text":"If you're unsure or a bit lost, make sure to check the full working examples .","title":"Lost?"},{"location":"migration/8x_to_9x/","text":"8.x.x \u27a1\ufe0f 9.x.x \u00b6 Version 9 revamps the authentication backends: we splitted the logic of a backend into two: the transport , which is how the token will be carried over the request and the strategy , which is how the token is generated and secured. The benefit of this is that we'll soon be able to propose new strategies, like database session tokens, without having to repeat the transport logic which remains the same. Convert the authentication backend \u00b6 You now have to generate an authentication backend with a transport and a strategy. I used JWTAuthentication \u00b6 Before After from fastapi_users.authentication import JWTAuthentication jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 , tokenUrl = \"auth/jwt/login\" ) from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends. I used CookieAuthentication \u00b6 Before After from fastapi_users.authentication import CookieAuthentication cookie_authentication = CookieAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) from fastapi_users.authentication import AuthenticationBackend , CookieTransport , JWTStrategy SECRET = \"SECRET\" cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"cookie\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends. Tip Notice that the strategy is the same for both authentication backends. That's the beauty of this approach: the token generation is decoupled from its transport. OAuth: one router for each backend \u00b6 Before, a single OAuth router was enough to login with any of your authentication backend. Now, you need to generate a router for each of your backends. Before After app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) authentication_backend is not needed on /authorize \u00b6 The consequence of this is that you don't need to specify the authentication backend when making a request to /authorize . Before After curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize?authentication_backend = jwt curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize Lost? \u00b6 If you're unsure or a bit lost, make sure to check the full working examples .","title":"8.x.x \u27a1\ufe0f 9.x.x"},{"location":"migration/8x_to_9x/#8xx-9xx","text":"Version 9 revamps the authentication backends: we splitted the logic of a backend into two: the transport , which is how the token will be carried over the request and the strategy , which is how the token is generated and secured. The benefit of this is that we'll soon be able to propose new strategies, like database session tokens, without having to repeat the transport logic which remains the same.","title":"8.x.x \u27a1\ufe0f 9.x.x"},{"location":"migration/8x_to_9x/#convert-the-authentication-backend","text":"You now have to generate an authentication backend with a transport and a strategy.","title":"Convert the authentication backend"},{"location":"migration/8x_to_9x/#i-used-jwtauthentication","text":"Before After from fastapi_users.authentication import JWTAuthentication jwt_authentication = JWTAuthentication ( secret = SECRET , lifetime_seconds = 3600 , tokenUrl = \"auth/jwt/login\" ) from fastapi_users.authentication import AuthenticationBackend , BearerTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends.","title":"I used JWTAuthentication"},{"location":"migration/8x_to_9x/#i-used-cookieauthentication","text":"Before After from fastapi_users.authentication import CookieAuthentication cookie_authentication = CookieAuthentication ( secret = SECRET , lifetime_seconds = 3600 ) from fastapi_users.authentication import AuthenticationBackend , CookieTransport , JWTStrategy SECRET = \"SECRET\" cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) auth_backend = AuthenticationBackend ( name = \"cookie\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) Warning There is no default name anymore: you need to provide it yourself for each of your backends. Tip Notice that the strategy is the same for both authentication backends. That's the beauty of this approach: the token generation is decoupled from its transport.","title":"I used CookieAuthentication"},{"location":"migration/8x_to_9x/#oauth-one-router-for-each-backend","text":"Before, a single OAuth router was enough to login with any of your authentication backend. Now, you need to generate a router for each of your backends. Before After app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_oauth_router ( google_oauth_client , auth_backend , \"SECRET\" ), prefix = \"/auth/google\" , tags = [ \"auth\" ], )","title":"OAuth: one router for each backend"},{"location":"migration/8x_to_9x/#authentication_backend-is-not-needed-on-authorize","text":"The consequence of this is that you don't need to specify the authentication backend when making a request to /authorize . Before After curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize?authentication_backend = jwt curl \\ -H \"Content-Type: application/json\" \\ -X GET \\ http://localhost:8000/auth/google/authorize","title":"authentication_backend is not needed on /authorize"},{"location":"migration/8x_to_9x/#lost","text":"If you're unsure or a bit lost, make sure to check the full working examples .","title":"Lost?"},{"location":"migration/9x_to_10x/","text":"9.x.x \u27a1\ufe0f 10.x.x \u00b6 Version 10 marks important changes in how we manage User models and their ID. Before, we were relying only on Pydantic models to work with users. In particular the current_user dependency would return you an instance of UserDB , a Pydantic model. This proved to be quite problematic with some ORM if you ever needed to retrieve relationship data or make specific requests. Now, FastAPI Users is designed to always return you a native object for your ORM model , whether it's an SQLAlchemy model or a Beanie document. Pydantic models are now only used for validation and serialization inside the API. Before, we were forcing the use of UUID as primary key ID; a consequence of the design above. This proved to be quite problematic on some databases, like MongoDB which uses a special ObjectID format by default. Some SQL folks also prefer to use traditional auto-increment integers. Now, FastAPI Users is designed to use generic ID type . It means that you can use any type you want for your user's ID. By default, SQLAlchemy adapter still use UUID; but you can quite easily switch to another thing, like an integer. Beanie adapter for MongoDB will use native ObjectID by default, but it also can be overriden. As you may have guessed, those changes imply quite a lot of breaking changes . User models and database adapter \u00b6 SQLAlchemy ORM \u00b6 We've removed the old SQLAlchemy dependency support, so the dependency is now fastapi-users[sqlalchemy] . Before After fastapi fastapi-users[sqlalchemy2] uvicorn[standard] aiosqlite fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite The User model base class for SQLAlchemy slightly changed to support UUID by default. We changed the name of the class from UserTable to User : it's not a compulsory change, but since there is no risk of confusion with Pydantic models anymore, it's probably a more idiomatic naming. Before After class UserTable ( Base , SQLAlchemyBaseUserTable ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): pass Instantiating the SQLAlchemyUserDatabase adapter now only expects this User model. UserDB is removed. Before After async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( UserDB , session , UserTable ) async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User ) MongoDB \u00b6 MongoDB support is now only provided through Beanie ODM . Even if you don't use it for the rest of your project, it's a very light addition that shouldn't interfere much. Before After fastapi fastapi-users[mongodb] uvicorn[standard] aiosqlite fastapi fastapi-users[beanie] uvicorn[standard] aiosqlite You now need to define a proper User model using Beanie. Before After import os import motor.motor_asyncio from fastapi_users.db import MongoDBUserDatabase from app.models import UserDB DATABASE_URL = os . environ [ \"DATABASE_URL\" ] client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] collection = db [ \"users\" ] async def get_user_db (): yield MongoDBUserDatabase ( UserDB , collection ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) ID are now ObjectID by default By default, User ID will now be native MongoDB ObjectID. If you don't want to make the transition and keep UUID you can do so by overriding the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Beanie also needs to be initialized in a startup event handler of your FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], ) Tortoise ORM and ormar \u00b6 Unfortunately, we sometimes need to make difficult choices to keep things sustainable. That's why we decided to not support Tortoise ORM and ormar anymore. It appeared they were not widely used. You can still add support for those ORM yourself by implementing the necessary adapter. You can take inspiration from the SQLAlchemy one . UserManager \u00b6 There is some slight changes on the UserManager class. In particular, it now needs a parse_id method that can be provided through built-in mixins. Generic typing now expects your native User model class and the type of ID . The user_db_model class property is removed . Before After class UserManager ( BaseUserManager [ UserCreate , UserDB ]): user_db_model = UserDB reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : UserDB , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) If you need to support other types of ID, you can read more about it in the dedicated section . Pydantic models \u00b6 To better distinguish them from the ORM models, Pydantic models are now called schemas . UserDB has been removed in favor of native models. We changed the name of User to UserRead : it's not a compulsory change, but since there is a risk of confusion with the native model, it's highly recommended. Besides, the BaseUser schema now accepts a generic type to specify the type of ID you use. Before After from fastapi_users import models class User ( models . BaseUser ): pass class UserCreate ( models . BaseUserCreate ): pass class UserUpdate ( models . BaseUserUpdate ): pass class UserDB ( User , models . BaseUserDB ): pass import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass FastAPI Users and routers \u00b6 Pydantic schemas are now way less important in this new design. As such, you don't need to pass them when initializing the FastAPIUsers class: Before After fastapi_users = FastAPIUsers ( get_user_manager , [ auth_backend ], User , UserCreate , UserUpdate , UserDB , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) As a consequence, those schemas need to be passed when initializing the router that needs them: get_register_router , get_verify_router and get_users_router . Before After app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router (), prefix = \"/auth\" , tags = [ \"auth\" ]) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], ) Lost? \u00b6 If you're unsure or a bit lost, make sure to check the full working examples .","title":"9.x.x \u27a1\ufe0f 10.x.x"},{"location":"migration/9x_to_10x/#9xx-10xx","text":"Version 10 marks important changes in how we manage User models and their ID. Before, we were relying only on Pydantic models to work with users. In particular the current_user dependency would return you an instance of UserDB , a Pydantic model. This proved to be quite problematic with some ORM if you ever needed to retrieve relationship data or make specific requests. Now, FastAPI Users is designed to always return you a native object for your ORM model , whether it's an SQLAlchemy model or a Beanie document. Pydantic models are now only used for validation and serialization inside the API. Before, we were forcing the use of UUID as primary key ID; a consequence of the design above. This proved to be quite problematic on some databases, like MongoDB which uses a special ObjectID format by default. Some SQL folks also prefer to use traditional auto-increment integers. Now, FastAPI Users is designed to use generic ID type . It means that you can use any type you want for your user's ID. By default, SQLAlchemy adapter still use UUID; but you can quite easily switch to another thing, like an integer. Beanie adapter for MongoDB will use native ObjectID by default, but it also can be overriden. As you may have guessed, those changes imply quite a lot of breaking changes .","title":"9.x.x \u27a1\ufe0f 10.x.x"},{"location":"migration/9x_to_10x/#user-models-and-database-adapter","text":"","title":"User models and database adapter"},{"location":"migration/9x_to_10x/#sqlalchemy-orm","text":"We've removed the old SQLAlchemy dependency support, so the dependency is now fastapi-users[sqlalchemy] . Before After fastapi fastapi-users[sqlalchemy2] uvicorn[standard] aiosqlite fastapi fastapi-users[sqlalchemy] uvicorn[standard] aiosqlite The User model base class for SQLAlchemy slightly changed to support UUID by default. We changed the name of the class from UserTable to User : it's not a compulsory change, but since there is no risk of confusion with Pydantic models anymore, it's probably a more idiomatic naming. Before After class UserTable ( Base , SQLAlchemyBaseUserTable ): pass class User ( SQLAlchemyBaseUserTableUUID , Base ): pass Instantiating the SQLAlchemyUserDatabase adapter now only expects this User model. UserDB is removed. Before After async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( UserDB , session , UserTable ) async def get_user_db ( session : AsyncSession = Depends ( get_async_session )): yield SQLAlchemyUserDatabase ( session , User )","title":"SQLAlchemy ORM"},{"location":"migration/9x_to_10x/#mongodb","text":"MongoDB support is now only provided through Beanie ODM . Even if you don't use it for the rest of your project, it's a very light addition that shouldn't interfere much. Before After fastapi fastapi-users[mongodb] uvicorn[standard] aiosqlite fastapi fastapi-users[beanie] uvicorn[standard] aiosqlite You now need to define a proper User model using Beanie. Before After import os import motor.motor_asyncio from fastapi_users.db import MongoDBUserDatabase from app.models import UserDB DATABASE_URL = os . environ [ \"DATABASE_URL\" ] client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] collection = db [ \"users\" ] async def get_user_db (): yield MongoDBUserDatabase ( UserDB , collection ) import motor.motor_asyncio from beanie import PydanticObjectId from fastapi_users.db import BeanieBaseUser , BeanieUserDatabase DATABASE_URL = \"mongodb://localhost:27017\" client = motor . motor_asyncio . AsyncIOMotorClient ( DATABASE_URL , uuidRepresentation = \"standard\" ) db = client [ \"database_name\" ] class User ( BeanieBaseUser [ PydanticObjectId ]): pass async def get_user_db (): yield BeanieUserDatabase ( User ) ID are now ObjectID by default By default, User ID will now be native MongoDB ObjectID. If you don't want to make the transition and keep UUID you can do so by overriding the id field: import uuid from pydantic import Field class User ( BeanieBaseUser [ uuid . UUID ]): id : uuid . UUID = Field ( default_factory = uuid . uuid4 ) Beanie also needs to be initialized in a startup event handler of your FastAPI app: from beanie import init_beanie @app . on_event ( \"startup\" ) async def on_startup (): await init_beanie ( database = db , document_models = [ User , ], )","title":"MongoDB"},{"location":"migration/9x_to_10x/#tortoise-orm-and-ormar","text":"Unfortunately, we sometimes need to make difficult choices to keep things sustainable. That's why we decided to not support Tortoise ORM and ormar anymore. It appeared they were not widely used. You can still add support for those ORM yourself by implementing the necessary adapter. You can take inspiration from the SQLAlchemy one .","title":"Tortoise ORM and ormar"},{"location":"migration/9x_to_10x/#usermanager","text":"There is some slight changes on the UserManager class. In particular, it now needs a parse_id method that can be provided through built-in mixins. Generic typing now expects your native User model class and the type of ID . The user_db_model class property is removed . Before After class UserManager ( BaseUserManager [ UserCreate , UserDB ]): user_db_model = UserDB reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : UserDB , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : UserDB , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) class UserManager ( UUIDIDMixin , BaseUserManager [ User , uuid . UUID ]): reset_password_token_secret = SECRET verification_token_secret = SECRET async def on_after_register ( self , user : User , request : Optional [ Request ] = None ): print ( f \"User { user . id } has registered.\" ) async def on_after_forgot_password ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"User { user . id } has forgot their password. Reset token: { token } \" ) async def on_after_request_verify ( self , user : User , token : str , request : Optional [ Request ] = None ): print ( f \"Verification requested for user { user . id } . Verification token: { token } \" ) If you need to support other types of ID, you can read more about it in the dedicated section .","title":"UserManager"},{"location":"migration/9x_to_10x/#pydantic-models","text":"To better distinguish them from the ORM models, Pydantic models are now called schemas . UserDB has been removed in favor of native models. We changed the name of User to UserRead : it's not a compulsory change, but since there is a risk of confusion with the native model, it's highly recommended. Besides, the BaseUser schema now accepts a generic type to specify the type of ID you use. Before After from fastapi_users import models class User ( models . BaseUser ): pass class UserCreate ( models . BaseUserCreate ): pass class UserUpdate ( models . BaseUserUpdate ): pass class UserDB ( User , models . BaseUserDB ): pass import uuid from fastapi_users import schemas class UserRead ( schemas . BaseUser [ uuid . UUID ]): pass class UserCreate ( schemas . BaseUserCreate ): pass class UserUpdate ( schemas . BaseUserUpdate ): pass","title":"Pydantic models"},{"location":"migration/9x_to_10x/#fastapi-users-and-routers","text":"Pydantic schemas are now way less important in this new design. As such, you don't need to pass them when initializing the FastAPIUsers class: Before After fastapi_users = FastAPIUsers ( get_user_manager , [ auth_backend ], User , UserCreate , UserUpdate , UserDB , ) fastapi_users = FastAPIUsers [ User , uuid . UUID ]( get_user_manager , [ auth_backend ], ) As a consequence, those schemas need to be passed when initializing the router that needs them: get_register_router , get_verify_router and get_users_router . Before After app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router (), prefix = \"/auth\" , tags = [ \"auth\" ]) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router (), prefix = \"/users\" , tags = [ \"users\" ]) app . include_router ( fastapi_users . get_auth_router ( auth_backend ), prefix = \"/auth/jwt\" , tags = [ \"auth\" ] ) app . include_router ( fastapi_users . get_register_router ( UserRead , UserCreate ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_reset_password_router (), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_verify_router ( UserRead ), prefix = \"/auth\" , tags = [ \"auth\" ], ) app . include_router ( fastapi_users . get_users_router ( UserRead , UserUpdate ), prefix = \"/users\" , tags = [ \"users\" ], )","title":"FastAPI Users and routers"},{"location":"migration/9x_to_10x/#lost","text":"If you're unsure or a bit lost, make sure to check the full working examples .","title":"Lost?"},{"location":"usage/current-user/","text":"Get current user \u00b6 FastAPI Users provides a dependency callable to easily inject authenticated user in your routes. They are available from your FastAPIUsers instance. Tip For more information about how to make an authenticated request to your API, check the documentation of your Authentication method . current_user \u00b6 Return a dependency callable to retrieve currently authenticated user, passing the following parameters: optional : If True , None is returned if there is no authenticated user or if it doesn't pass the other requirements. Otherwise, throw 401 Unauthorized . Defaults to False . active : If True , throw 401 Unauthorized if the authenticated user is inactive. Defaults to False . verified : If True , throw 403 Forbidden if the authenticated user is not verified. Defaults to False . superuser : If True , throw 403 Forbidden if the authenticated user is not a superuser. Defaults to False . get_enabled_backends : Optional dependency callable returning a list of enabled authentication backends. Useful if you want to dynamically enable some authentication backends based on external logic, like a configuration in database. By default, all specified authentication backends are enabled. Please not however that every backends will appear in the OpenAPI documentation, as FastAPI resolves it statically. Create it once and reuse it This function is a factory , a function returning another function \ud83e\udd2f It's this returned function that will be the dependency called by FastAPI in your API routes. To avoid having to generate it on each route and avoid issues when unit testing, it's strongly recommended that you assign the result in a variable and reuse it at will in your routes. The examples below demonstrate this pattern. Examples \u00b6 Get the current user ( active or not ) \u00b6 current_user = fastapi_users . current_user () @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_user )): return f \"Hello, { user . email } \" Get the current active user \u00b6 current_active_user = fastapi_users . current_user ( active = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } \" Get the current active and verified user \u00b6 current_active_verified_user = fastapi_users . current_user ( active = True , verified = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_verified_user )): return f \"Hello, { user . email } \" Get the current active superuser \u00b6 current_superuser = fastapi_users . current_user ( active = True , superuser = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_superuser )): return f \"Hello, { user . email } \" Dynamically enable authentication backends \u00b6 Warning This is an advanced feature for cases where you have several authentication backends that are enabled conditionally. In most cases, you won't need this option. from fastapi import Request from fastapi_users.authentication import AuthenticationBackend , BearerTransport , CookieTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) jwt_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) cookie_backend = AuthenticationBackend ( name = \"jwt\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) async def get_enabled_backends ( request : Request ): \"\"\"Return the enabled dependencies following custom logic.\"\"\" if request . url . path == \"/protected-route-only-jwt\" : return [ jwt_backend ] else : return [ cookie_backend , jwt_backend ] current_active_user = fastapi_users . current_user ( active = True , get_enabled_backends = get_enabled_backends ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a cookie or a JWT.\" @app . get ( \"/protected-route-only-jwt\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a JWT.\" In a path operation \u00b6 If you don't need the user in the route logic, you can use this syntax: @app . get ( \"/protected-route\" , dependencies = [ Depends ( current_superuser )]) def protected_route (): return \"Hello, some user.\" You can read more about this in FastAPI docs .","title":"Get current user"},{"location":"usage/current-user/#get-current-user","text":"FastAPI Users provides a dependency callable to easily inject authenticated user in your routes. They are available from your FastAPIUsers instance. Tip For more information about how to make an authenticated request to your API, check the documentation of your Authentication method .","title":"Get current user"},{"location":"usage/current-user/#current_user","text":"Return a dependency callable to retrieve currently authenticated user, passing the following parameters: optional : If True , None is returned if there is no authenticated user or if it doesn't pass the other requirements. Otherwise, throw 401 Unauthorized . Defaults to False . active : If True , throw 401 Unauthorized if the authenticated user is inactive. Defaults to False . verified : If True , throw 403 Forbidden if the authenticated user is not verified. Defaults to False . superuser : If True , throw 403 Forbidden if the authenticated user is not a superuser. Defaults to False . get_enabled_backends : Optional dependency callable returning a list of enabled authentication backends. Useful if you want to dynamically enable some authentication backends based on external logic, like a configuration in database. By default, all specified authentication backends are enabled. Please not however that every backends will appear in the OpenAPI documentation, as FastAPI resolves it statically. Create it once and reuse it This function is a factory , a function returning another function \ud83e\udd2f It's this returned function that will be the dependency called by FastAPI in your API routes. To avoid having to generate it on each route and avoid issues when unit testing, it's strongly recommended that you assign the result in a variable and reuse it at will in your routes. The examples below demonstrate this pattern.","title":"current_user"},{"location":"usage/current-user/#examples","text":"","title":"Examples"},{"location":"usage/current-user/#get-the-current-user-active-or-not","text":"current_user = fastapi_users . current_user () @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_user )): return f \"Hello, { user . email } \"","title":"Get the current user (active or not)"},{"location":"usage/current-user/#get-the-current-active-user","text":"current_active_user = fastapi_users . current_user ( active = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } \"","title":"Get the current active user"},{"location":"usage/current-user/#get-the-current-active-and-verified-user","text":"current_active_verified_user = fastapi_users . current_user ( active = True , verified = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_verified_user )): return f \"Hello, { user . email } \"","title":"Get the current active and verified user"},{"location":"usage/current-user/#get-the-current-active-superuser","text":"current_superuser = fastapi_users . current_user ( active = True , superuser = True ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_superuser )): return f \"Hello, { user . email } \"","title":"Get the current active superuser"},{"location":"usage/current-user/#dynamically-enable-authentication-backends","text":"Warning This is an advanced feature for cases where you have several authentication backends that are enabled conditionally. In most cases, you won't need this option. from fastapi import Request from fastapi_users.authentication import AuthenticationBackend , BearerTransport , CookieTransport , JWTStrategy SECRET = \"SECRET\" bearer_transport = BearerTransport ( tokenUrl = \"auth/jwt/login\" ) cookie_transport = CookieTransport ( cookie_max_age = 3600 ) def get_jwt_strategy () -> JWTStrategy : return JWTStrategy ( secret = SECRET , lifetime_seconds = 3600 ) jwt_backend = AuthenticationBackend ( name = \"jwt\" , transport = bearer_transport , get_strategy = get_jwt_strategy , ) cookie_backend = AuthenticationBackend ( name = \"jwt\" , transport = cookie_transport , get_strategy = get_jwt_strategy , ) async def get_enabled_backends ( request : Request ): \"\"\"Return the enabled dependencies following custom logic.\"\"\" if request . url . path == \"/protected-route-only-jwt\" : return [ jwt_backend ] else : return [ cookie_backend , jwt_backend ] current_active_user = fastapi_users . current_user ( active = True , get_enabled_backends = get_enabled_backends ) @app . get ( \"/protected-route\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a cookie or a JWT.\" @app . get ( \"/protected-route-only-jwt\" ) def protected_route ( user : User = Depends ( current_active_user )): return f \"Hello, { user . email } . You are authenticated with a JWT.\"","title":"Dynamically enable authentication backends"},{"location":"usage/current-user/#in-a-path-operation","text":"If you don't need the user in the route logic, you can use this syntax: @app . get ( \"/protected-route\" , dependencies = [ Depends ( current_superuser )]) def protected_route (): return \"Hello, some user.\" You can read more about this in FastAPI docs .","title":"In a path operation"},{"location":"usage/flow/","text":"Flow \u00b6 This page will present you a complete registration and authentication flow once you've setup FastAPI Users . Each example will be presented with a cURL and an axios example. 1. Registration \u00b6 First step, of course, is to register as a user. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -X POST \\ -d \"{\\\"email\\\": \\\"king.arthur@camelot.bt\\\",\\\"password\\\": \\\"guinevere\\\"}\" \\ http://localhost:8000/auth/register axios . post ( 'http://localhost:8000/auth/register' , { email : 'king.arthur@camelot.bt' , password : 'guinevere' , }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Several things to bear in mind: If you have defined other required fields in your User model (like a first name or a birthdate), you'll have to provide them in the payload. The user is active by default. The user cannot set is_active or is_superuser itself at registration. Only a superuser can do it by PATCHing the user. 2. Login \u00b6 Now, you can login as this new user. You can generate a login route for each authentication backend . Each backend will have a different response. Bearer + JWT \u00b6 Request \u00b6 cURL axios curl \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/jwt/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/jwt/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username . Response \u00b6 You'll get a JSON response looking like this: { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" , \"token_type\" : \"bearer\" } You can use this token to make authenticated requests as the user king.arthur@camelot.bt . We'll see how in the next section. Cookie + JWT \u00b6 Request \u00b6 cURL axios curl \\ -v \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/cookie/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/cookie/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username . Response \u00b6 You'll get an empty response. However, the response will come with a Set-Cookie header (that's why we added the -v option in cURL to see them). set-cookie: fastapiusersauth=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYzYwNjBmMTEtNTM0OS00YTI0LThiNGEtYTJhODc1ZGM1Mzk1IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4OTQ3fQ.qNA4oPVYhoqrJIk-zvAyEfEVoEnP156G30H_SWEU0sU; HttpOnly; Max-Age=3600; Path=/; Secure You can make authenticated requests as the user king.arthur@camelot.bt by setting a Cookie header with this cookie. Tip The cookie backend is more suited for browsers, as they handle them automatically. This means that if you make a login request in the browser, it will automatically store the cookie and automatically send it in subsequent requests. 3. Get my profile \u00b6 Now that we can authenticate, we can get our own profile data. Depending on your authentication backend , the method to authenticate the request will vary. We'll stick with JWT from now on. Request \u00b6 cURL axios export TOKEN = \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" ; curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/me const TOKEN = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM' ; axios . get ( 'http://localhost:8000/users/me' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Tip If you use one of the dependency callable to protect one of your own endpoint, you'll have to authenticate exactly in the same way. 4. Update my profile \u00b6 We can also update our own profile. For example, we can change our password like this. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"password\\\": \\\"lancelot\\\"}\" \\ http://localhost:8000/users/me axios . patch ( 'http://localhost:8000/users/me' , { password : 'lancelot' , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Once again, the user cannot set is_active or is_superuser itself. Only a superuser can do it by PATCHing the user. 5. Become a superuser \ud83e\uddb8\ud83c\udffb\u200d\u2642\ufe0f \u00b6 If you want to manage the users of your application, you'll have to become a superuser . The very first superuser can only be set at database level : open it through a CLI or a GUI, find your user and set the is_superuser column/property to true . 5.1. Get the profile of any user \u00b6 Now that you are a superuser, you can leverage the power of superuser routes . You can for example get the profile of any user in the database given its id. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . get ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 5.1. Update any user \u00b6 We can now update the profile of any user. For example, we can promote it as superuser. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"is_superuser\\\": true}\" \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . patch ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { is_superuser : true , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : true } 5.2. Delete any user \u00b6 Finally, we can delete a user. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X DELETE \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . delete ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get an empty response. 6. Logout \u00b6 We can also end the session. Request \u00b6 cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Cookie: fastapiusersauth= $TOKEN \" \\ -X POST \\ http://localhost:8000/auth/cookie/logout axios . post ( 'http://localhost:8000/auth/cookie/logout' , null , { headers : { 'Cookie' : `fastapiusersauth= ${ TOKEN } ` , }, } ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Response \u00b6 You'll get an empty response. Conclusion \u00b6 That's it! You now have a good overview of how you can manage the users through the API. Be sure to check the Routes page to have all the details about each endpoints.","title":"Flow"},{"location":"usage/flow/#flow","text":"This page will present you a complete registration and authentication flow once you've setup FastAPI Users . Each example will be presented with a cURL and an axios example.","title":"Flow"},{"location":"usage/flow/#1-registration","text":"First step, of course, is to register as a user.","title":"1. Registration"},{"location":"usage/flow/#request","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -X POST \\ -d \"{\\\"email\\\": \\\"king.arthur@camelot.bt\\\",\\\"password\\\": \\\"guinevere\\\"}\" \\ http://localhost:8000/auth/register axios . post ( 'http://localhost:8000/auth/register' , { email : 'king.arthur@camelot.bt' , password : 'guinevere' , }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Several things to bear in mind: If you have defined other required fields in your User model (like a first name or a birthdate), you'll have to provide them in the payload. The user is active by default. The user cannot set is_active or is_superuser itself at registration. Only a superuser can do it by PATCHing the user.","title":"Response"},{"location":"usage/flow/#2-login","text":"Now, you can login as this new user. You can generate a login route for each authentication backend . Each backend will have a different response.","title":"2. Login"},{"location":"usage/flow/#bearer-jwt","text":"","title":"Bearer + JWT"},{"location":"usage/flow/#request_1","text":"cURL axios curl \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/jwt/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/jwt/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username .","title":"Request"},{"location":"usage/flow/#response_1","text":"You'll get a JSON response looking like this: { \"access_token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" , \"token_type\" : \"bearer\" } You can use this token to make authenticated requests as the user king.arthur@camelot.bt . We'll see how in the next section.","title":"Response"},{"location":"usage/flow/#cookie-jwt","text":"","title":"Cookie + JWT"},{"location":"usage/flow/#request_2","text":"cURL axios curl \\ -v \\ -H \"Content-Type: multipart/form-data\" \\ -X POST \\ -F \"username=king.arthur@camelot.bt\" \\ -F \"password=guinevere\" \\ http://localhost:8000/auth/cookie/login const formData = new FormData (); formData . set ( 'username' , 'king.arthur@camelot.bt' ); formData . set ( 'password' , 'guinevere' ); axios . post ( 'http://localhost:8000/auth/cookie/login' , formData , { headers : { 'Content-Type' : 'multipart/form-data' , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error )); Warning Notice that we don't send it as a JSON payload here but with form data instead. Also, the email is provided by a field named username .","title":"Request"},{"location":"usage/flow/#response_2","text":"You'll get an empty response. However, the response will come with a Set-Cookie header (that's why we added the -v option in cURL to see them). set-cookie: fastapiusersauth=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYzYwNjBmMTEtNTM0OS00YTI0LThiNGEtYTJhODc1ZGM1Mzk1IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4OTQ3fQ.qNA4oPVYhoqrJIk-zvAyEfEVoEnP156G30H_SWEU0sU; HttpOnly; Max-Age=3600; Path=/; Secure You can make authenticated requests as the user king.arthur@camelot.bt by setting a Cookie header with this cookie. Tip The cookie backend is more suited for browsers, as they handle them automatically. This means that if you make a login request in the browser, it will automatically store the cookie and automatically send it in subsequent requests.","title":"Response"},{"location":"usage/flow/#3-get-my-profile","text":"Now that we can authenticate, we can get our own profile data. Depending on your authentication backend , the method to authenticate the request will vary. We'll stick with JWT from now on.","title":"3. Get my profile"},{"location":"usage/flow/#request_3","text":"cURL axios export TOKEN = \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM\" ; curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/me const TOKEN = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiNGZkMzQ3N2ItZWNjZi00ZWUzLThmN2QtNjhhZDcyMjYxNDc2IiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTg3ODE4NDI5fQ.anO3JR8-WYCozZ4_2-PQ2Ov9O38RaLP2RAzQIiZhteM' ; axios . get ( 'http://localhost:8000/users/me' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_3","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Tip If you use one of the dependency callable to protect one of your own endpoint, you'll have to authenticate exactly in the same way.","title":"Response"},{"location":"usage/flow/#4-update-my-profile","text":"We can also update our own profile. For example, we can change our password like this.","title":"4. Update my profile"},{"location":"usage/flow/#request_4","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"password\\\": \\\"lancelot\\\"}\" \\ http://localhost:8000/users/me axios . patch ( 'http://localhost:8000/users/me' , { password : 'lancelot' , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_4","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } Info Once again, the user cannot set is_active or is_superuser itself. Only a superuser can do it by PATCHing the user.","title":"Response"},{"location":"usage/flow/#5-become-a-superuser","text":"If you want to manage the users of your application, you'll have to become a superuser . The very first superuser can only be set at database level : open it through a CLI or a GUI, find your user and set the is_superuser column/property to true .","title":"5. Become a superuser \ud83e\uddb8\ud83c\udffb\u200d\u2642\ufe0f"},{"location":"usage/flow/#51-get-the-profile-of-any-user","text":"Now that you are a superuser, you can leverage the power of superuser routes . You can for example get the profile of any user in the database given its id.","title":"5.1. Get the profile of any user"},{"location":"usage/flow/#request_5","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X GET \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . get ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_5","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false }","title":"Response"},{"location":"usage/flow/#51-update-any-user","text":"We can now update the profile of any user. For example, we can promote it as superuser.","title":"5.1. Update any user"},{"location":"usage/flow/#request_6","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X PATCH \\ -d \"{\\\"is_superuser\\\": true}\" \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . patch ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { is_superuser : true , }, { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_6","text":"You'll get a JSON response looking like this: { \"id\" : \"4fd3477b-eccf-4ee3-8f7d-68ad72261476\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : true }","title":"Response"},{"location":"usage/flow/#52-delete-any-user","text":"Finally, we can delete a user.","title":"5.2. Delete any user"},{"location":"usage/flow/#request_7","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer $TOKEN \" \\ -X DELETE \\ http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476 axios . delete ( 'http://localhost:8000/users/4fd3477b-eccf-4ee3-8f7d-68ad72261476' , { headers : { 'Authorization' : `Bearer ${ TOKEN } ` , }, }, ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_7","text":"You'll get an empty response.","title":"Response"},{"location":"usage/flow/#6-logout","text":"We can also end the session.","title":"6. Logout"},{"location":"usage/flow/#request_8","text":"cURL axios curl \\ -H \"Content-Type: application/json\" \\ -H \"Cookie: fastapiusersauth= $TOKEN \" \\ -X POST \\ http://localhost:8000/auth/cookie/logout axios . post ( 'http://localhost:8000/auth/cookie/logout' , null , { headers : { 'Cookie' : `fastapiusersauth= ${ TOKEN } ` , }, } ) . then (( response ) => console . log ( response )) . catch (( error ) => console . log ( error ));","title":"Request"},{"location":"usage/flow/#response_8","text":"You'll get an empty response.","title":"Response"},{"location":"usage/flow/#conclusion","text":"That's it! You now have a good overview of how you can manage the users through the API. Be sure to check the Routes page to have all the details about each endpoints.","title":"Conclusion"},{"location":"usage/routes/","text":"Routes \u00b6 You'll find here the routes exposed by FastAPI Users . Note that you can also review them through the interactive API docs . Auth router \u00b6 Each authentication backend you generate a router for will produce the following routes. Take care about the prefix you gave it, especially if you have several backends. POST /login \u00b6 Login a user against the method named name . Check the corresponding authentication method to view the success response. Payload ( application/x-www-form-urlencoded ) username=king.arthur@camelot.bt&password=guinevere 422 Validation Error 400 Bad Request Bad credentials or the user is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" } 400 Bad Request The user is not verified. { \"detail\" : \"LOGIN_USER_NOT_VERIFIED\" } POST /logout \u00b6 Logout the authenticated user against the method named name . Check the corresponding authentication method to view the success response. 401 Unauthorized Missing token or inactive user. 200 OK The logout process was successful. Register router \u00b6 POST /register \u00b6 Register a new user. Will call the on_after_register handler on successful registration. Payload { \"email\" : \"king.arthur@camelot.bt\" , \"password\" : \"guinevere\" } 201 Created { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 422 Validation Error 400 Bad Request A user already exists with this email. { \"detail\" : \"REGISTER_USER_ALREADY_EXISTS\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"REGISTER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } Reset password router \u00b6 POST /forgot-password \u00b6 Request a reset password procedure. Will generate a temporary token and call the on_after_forgot_password handler if the user exists. To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted POST /reset-password \u00b6 Reset a password. Requires the token generated by the /forgot-password route. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"password\" : \"merlin\" } 200 OK 422 Validation Error 400 Bad Request Bad or expired token. { \"detail\" : \"RESET_PASSWORD_BAD_TOKEN\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"RESET_PASSWORD_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } Verify router \u00b6 POST /request-verify-token \u00b6 Request a user to verify their e-mail. Will generate a temporary token and call the on_after_request_verify handler if the user exists , active and not already verified . To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist, not active or already verified. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted POST /verify \u00b6 Verify a user. Requires the token generated by the /request-verify-token route. Will call the call the on_after_verify handler on success. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } 200 OK 422 Validation Error 400 Bad Request Bad token, not existing user or not the e-mail currently set for the user. { \"detail\" : \"VERIFY_USER_BAD_TOKEN\" } 400 Bad Request The user is already verified. { \"detail\" : \"VERIFY_USER_ALREADY_VERIFIED\" } OAuth router \u00b6 Each OAuth router you define will expose the two following routes. GET /authorize \u00b6 Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" } GET /callback \u00b6 Handle the OAuth callback. Query parameters code : OAuth callback code. state : State token. error : OAuth error. Depending on the situation, several things can happen: The OAuth account exists in database and is linked to a user: OAuth account is updated in database with fresh access token. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database but a user with the same email address exists: By default, an HTTP 400 error is raised. If the associate_by_email flag is set to True on the router declaration, OAuth account is linked to the user. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database and no user with the email address exists: A new user is created and linked to the OAuth account. The user is authenticated following the chosen authentication method . 400 Bad Request Invalid token. 400 Bad Request The OAuth provider didn't return an e-mail address. Make sure this provider return e-mail address through their API and you have asked for the required scope. { \"detail\" : \"OAUTH_NOT_AVAILABLE_EMAIL\" } 400 Bad Request Another user with the same e-mail address already exists. { \"detail\" : \"OAUTH_USER_ALREADY_EXISTS\" } 400 Bad Request User is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" } OAuth association router \u00b6 Each OAuth association router you define will expose the two following routes. GET /authorize \u00b6 Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 401 Unauthorized Missing token or inactive user. 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" } GET /callback \u00b6 Handle the OAuth callback and add the OAuth account to the current authenticated active user. Query parameters code : OAuth callback code. state : State token. error : OAuth error. 401 Unauthorized Missing token or inactive user. 400 Bad Request Invalid token. 400 Bad Request The OAuth provider didn't return an e-mail address. Make sure this provider return e-mail address through their API and you have asked for the required scope. { \"detail\" : \"OAUTH_NOT_AVAILABLE_EMAIL\" } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false , \"oauth_accounts\" : [ { \"id\" : \"6c98caf5-9bc5-4c4f-8a45-a0ae0c40cd77\" , \"oauth_name\" : \"TINTAGEL\" , \"access_token\" : \"ACCESS_TOKEN\" , \"expires_at\" : \"1641040620\" , \"account_id\" : \"king_arthur_tintagel\" , \"account_email\" : \"king.arthur@tintagel.bt\" } ] } Users router \u00b6 GET /me \u00b6 Return the current authenticated active user. 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. PATCH /me \u00b6 Update the current authenticated active user. Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" } 422 Validation Error GET /{user_id} \u00b6 Return the user with id user_id . 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist. PATCH /{user_id} \u00b6 Update the user with id user_id . Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" , \"is_active\" : false , \"is_superuser\" : true } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : false , \"is_superuser\" : true } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" } DELETE /{user_id} \u00b6 Delete the user with id user_id . 204 No content 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist.","title":"Routes"},{"location":"usage/routes/#routes","text":"You'll find here the routes exposed by FastAPI Users . Note that you can also review them through the interactive API docs .","title":"Routes"},{"location":"usage/routes/#auth-router","text":"Each authentication backend you generate a router for will produce the following routes. Take care about the prefix you gave it, especially if you have several backends.","title":"Auth router"},{"location":"usage/routes/#post-login","text":"Login a user against the method named name . Check the corresponding authentication method to view the success response. Payload ( application/x-www-form-urlencoded ) username=king.arthur@camelot.bt&password=guinevere 422 Validation Error 400 Bad Request Bad credentials or the user is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" } 400 Bad Request The user is not verified. { \"detail\" : \"LOGIN_USER_NOT_VERIFIED\" }","title":"POST /login"},{"location":"usage/routes/#post-logout","text":"Logout the authenticated user against the method named name . Check the corresponding authentication method to view the success response. 401 Unauthorized Missing token or inactive user. 200 OK The logout process was successful.","title":"POST /logout"},{"location":"usage/routes/#register-router","text":"","title":"Register router"},{"location":"usage/routes/#post-register","text":"Register a new user. Will call the on_after_register handler on successful registration. Payload { \"email\" : \"king.arthur@camelot.bt\" , \"password\" : \"guinevere\" } 201 Created { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 422 Validation Error 400 Bad Request A user already exists with this email. { \"detail\" : \"REGISTER_USER_ALREADY_EXISTS\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"REGISTER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } }","title":"POST /register"},{"location":"usage/routes/#reset-password-router","text":"","title":"Reset password router"},{"location":"usage/routes/#post-forgot-password","text":"Request a reset password procedure. Will generate a temporary token and call the on_after_forgot_password handler if the user exists. To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted","title":"POST /forgot-password"},{"location":"usage/routes/#post-reset-password","text":"Reset a password. Requires the token generated by the /forgot-password route. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" , \"password\" : \"merlin\" } 200 OK 422 Validation Error 400 Bad Request Bad or expired token. { \"detail\" : \"RESET_PASSWORD_BAD_TOKEN\" } 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"RESET_PASSWORD_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } }","title":"POST /reset-password"},{"location":"usage/routes/#verify-router","text":"","title":"Verify router"},{"location":"usage/routes/#post-request-verify-token","text":"Request a user to verify their e-mail. Will generate a temporary token and call the on_after_request_verify handler if the user exists , active and not already verified . To prevent malicious users from guessing existing users in your database, the route will always return a 202 Accepted response, even if the user requested does not exist, not active or already verified. Payload { \"email\" : \"king.arthur@camelot.bt\" } 202 Accepted","title":"POST /request-verify-token"},{"location":"usage/routes/#post-verify","text":"Verify a user. Requires the token generated by the /request-verify-token route. Will call the call the on_after_verify handler on success. Payload { \"token\" : \"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiOTIyMWZmYzktNjQwZi00MzcyLTg2ZDMtY2U2NDJjYmE1NjAzIiwiYXVkIjoiZmFzdGFwaS11c2VyczphdXRoIiwiZXhwIjoxNTcxNTA0MTkzfQ.M10bjOe45I5Ncu_uXvOmVV8QxnL-nZfcH96U90JaocI\" } 200 OK 422 Validation Error 400 Bad Request Bad token, not existing user or not the e-mail currently set for the user. { \"detail\" : \"VERIFY_USER_BAD_TOKEN\" } 400 Bad Request The user is already verified. { \"detail\" : \"VERIFY_USER_ALREADY_VERIFIED\" }","title":"POST /verify"},{"location":"usage/routes/#oauth-router","text":"Each OAuth router you define will expose the two following routes.","title":"OAuth router"},{"location":"usage/routes/#get-authorize","text":"Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" }","title":"GET /authorize"},{"location":"usage/routes/#get-callback","text":"Handle the OAuth callback. Query parameters code : OAuth callback code. state : State token. error : OAuth error. Depending on the situation, several things can happen: The OAuth account exists in database and is linked to a user: OAuth account is updated in database with fresh access token. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database but a user with the same email address exists: By default, an HTTP 400 error is raised. If the associate_by_email flag is set to True on the router declaration, OAuth account is linked to the user. The user is authenticated following the chosen authentication method . The OAuth account doesn't exist in database and no user with the email address exists: A new user is created and linked to the OAuth account. The user is authenticated following the chosen authentication method . 400 Bad Request Invalid token. 400 Bad Request The OAuth provider didn't return an e-mail address. Make sure this provider return e-mail address through their API and you have asked for the required scope. { \"detail\" : \"OAUTH_NOT_AVAILABLE_EMAIL\" } 400 Bad Request Another user with the same e-mail address already exists. { \"detail\" : \"OAUTH_USER_ALREADY_EXISTS\" } 400 Bad Request User is inactive. { \"detail\" : \"LOGIN_BAD_CREDENTIALS\" }","title":"GET /callback"},{"location":"usage/routes/#oauth-association-router","text":"Each OAuth association router you define will expose the two following routes.","title":"OAuth association router"},{"location":"usage/routes/#get-authorize_1","text":"Return the authorization URL for the OAuth service where you should redirect your user. Query parameters scopes : Optional list of scopes to ask for. Expected format: scopes=a&scopes=b . 401 Unauthorized Missing token or inactive user. 200 OK { \"authorization_url\" : \"https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback\" }","title":"GET /authorize"},{"location":"usage/routes/#get-callback_1","text":"Handle the OAuth callback and add the OAuth account to the current authenticated active user. Query parameters code : OAuth callback code. state : State token. error : OAuth error. 401 Unauthorized Missing token or inactive user. 400 Bad Request Invalid token. 400 Bad Request The OAuth provider didn't return an e-mail address. Make sure this provider return e-mail address through their API and you have asked for the required scope. { \"detail\" : \"OAUTH_NOT_AVAILABLE_EMAIL\" } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false , \"oauth_accounts\" : [ { \"id\" : \"6c98caf5-9bc5-4c4f-8a45-a0ae0c40cd77\" , \"oauth_name\" : \"TINTAGEL\" , \"access_token\" : \"ACCESS_TOKEN\" , \"expires_at\" : \"1641040620\" , \"account_id\" : \"king_arthur_tintagel\" , \"account_email\" : \"king.arthur@tintagel.bt\" } ] }","title":"GET /callback"},{"location":"usage/routes/#users-router","text":"","title":"Users router"},{"location":"usage/routes/#get-me","text":"Return the current authenticated active user. 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user.","title":"GET /me"},{"location":"usage/routes/#patch-me","text":"Update the current authenticated active user. Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@tintagel.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" } 422 Validation Error","title":"PATCH /me"},{"location":"usage/routes/#get-user_id","text":"Return the user with id user_id . 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : true , \"is_superuser\" : false } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist.","title":"GET /{user_id}"},{"location":"usage/routes/#patch-user_id","text":"Update the user with id user_id . Payload { \"email\" : \"king.arthur@tintagel.bt\" , \"password\" : \"merlin\" , \"is_active\" : false , \"is_superuser\" : true } 200 OK { \"id\" : \"57cbb51a-ab71-4009-8802-3f54b4f2e23\" , \"email\" : \"king.arthur@camelot.bt\" , \"is_active\" : false , \"is_superuser\" : true } 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist. 400 Bad Request Password validation failed. { \"detail\" : { \"code\" : \"UPDATE_USER_INVALID_PASSWORD\" , \"reason\" : \"Password should be at least 3 characters\" } } 400 Bad Request A user with this email already exists. { \"detail\" : \"UPDATE_USER_EMAIL_ALREADY_EXISTS\" }","title":"PATCH /{user_id}"},{"location":"usage/routes/#delete-user_id","text":"Delete the user with id user_id . 204 No content 401 Unauthorized Missing token or inactive user. 403 Forbidden Not a superuser. 404 Not found The user does not exist.","title":"DELETE /{user_id}"}]} \ No newline at end of file diff --git a/10.2/sitemap.xml b/10.2/sitemap.xml index bb9c65fb..ec17029e 100644 --- a/10.2/sitemap.xml +++ b/10.2/sitemap.xml @@ -2,182 +2,182 @@ None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily None - 2022-10-18 + 2022-11-04 daily \ No newline at end of file diff --git a/10.2/sitemap.xml.gz b/10.2/sitemap.xml.gz index 57428a337bc27c2bbb5a18bb63cda9a8df0162bc..37eb76dd177bf8fffc02f040acf098614d488099 100644 GIT binary patch literal 217 zcmb2|=HTeNl#kaqk_WAKI@9w5 z+0CZOKHI~&(3+9wu)t!@UAopiweifW()K8Aqy*^({H|teNT6DeJC%kF!q+mHI8X!Bb4IPUT^Xu%87g@k9R6=SHg& N`cGA3SQ&*F7yuSTWugE8 literal 217 zcmb2|=HL(u@JnX;Uz}NznwwalSCN~;@b;`PUz33V>w~?^Gj=U!4a@MlxwB*`dqx6_ zP{zcSi?(n7bEJSh-E8i@eP4o)?tXuR+bw7A*-E9Pa|foa%gUYm`Sw?t)IAs2zsgv% zoOimJbWZwx`{XH?O*nIGzoa=lJQkI7vxWPV?v#xdMYRcu&-kz9N?zR=6hDVm^?C09 zgbUx-UCNxZEKtbZQ%oy*+v=&k8%^)HSG+j2<*xh5*iBuZ+=cus9<~Uh68{zV$#BHg OGkP48TFxlMzyJW8L}my8 diff --git a/10.2/usage/routes/index.html b/10.2/usage/routes/index.html index fa6b7538..ea304ec7 100644 --- a/10.2/usage/routes/index.html +++ b/10.2/usage/routes/index.html @@ -1663,7 +1663,7 @@

Password validation failed.

{
     "detail": {
-        "code": "REGISTER_INVALID_PASSWORD",
+        "code": "RESET_PASSWORD_INVALID_PASSWORD",
         "reason": "Password should be at least 3 characters"
     }
 }
@@ -1765,20 +1765,28 @@

400 Bad Request

-

Another user with the same e-mail address already exists.

+

The OAuth provider didn't return an e-mail address. Make sure this provider return e-mail address through their API and you have asked for the required scope.

{
-    "detail": "OAUTH_USER_ALREADY_EXISTS"
+    "detail": "OAUTH_NOT_AVAILABLE_EMAIL"
 }

400 Bad Request

-

User is inactive.

+

Another user with the same e-mail address already exists.

{
-    "detail": "LOGIN_BAD_CREDENTIALS"
+    "detail": "OAUTH_USER_ALREADY_EXISTS"
 }
+
+

400 Bad Request

+

User is inactive.

+
{
+    "detail": "LOGIN_BAD_CREDENTIALS"
+}
+
+

OAuth association router

Each OAuth association router you define will expose the two following routes.

GET /authorize

@@ -1795,9 +1803,9 @@

200 OK

-
{
-    "authorization_url": "https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback"
-}
+
{
+    "authorization_url": "https://www.tintagel.bt/oauth/authorize?client_id=CLIENT_ID&scopes=a+b&redirect_uri=https://www.camelot.bt/oauth/callback"
+}

GET /callback

@@ -1818,24 +1826,32 @@

400 Bad Request

Invalid token.

+
+

400 Bad Request

+

The OAuth provider didn't return an e-mail address. Make sure this provider return e-mail address through their API and you have asked for the required scope.

+
{
+    "detail": "OAUTH_NOT_AVAILABLE_EMAIL"
+}
+
+

200 OK

-
{
-    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
-    "email": "king.arthur@tintagel.bt",
-    "is_active": true,
-    "is_superuser": false,
-    "oauth_accounts": [
-        {
-            "id": "6c98caf5-9bc5-4c4f-8a45-a0ae0c40cd77",
-            "oauth_name": "TINTAGEL",
-            "access_token": "ACCESS_TOKEN",
-            "expires_at": "1641040620",
-            "account_id": "king_arthur_tintagel",
-            "account_email": "king.arthur@tintagel.bt"
-        }
-    ]
-}
+
{
+    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
+    "email": "king.arthur@tintagel.bt",
+    "is_active": true,
+    "is_superuser": false,
+    "oauth_accounts": [
+        {
+            "id": "6c98caf5-9bc5-4c4f-8a45-a0ae0c40cd77",
+            "oauth_name": "TINTAGEL",
+            "access_token": "ACCESS_TOKEN",
+            "expires_at": "1641040620",
+            "account_id": "king_arthur_tintagel",
+            "account_email": "king.arthur@tintagel.bt"
+        }
+    ]
+}

Users router

@@ -1843,12 +1859,12 @@

Return the current authenticated active user.

200 OK

-
{
-    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
-    "email": "king.arthur@camelot.bt",
-    "is_active": true,
-    "is_superuser": false
-}
+
{
+    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
+    "email": "king.arthur@camelot.bt",
+    "is_active": true,
+    "is_superuser": false
+}
@@ -1859,20 +1875,20 @@

Update the current authenticated active user.

Payload

-
{
-    "email": "king.arthur@tintagel.bt",
-    "password": "merlin"
-}
+
{
+    "email": "king.arthur@tintagel.bt",
+    "password": "merlin"
+}

200 OK

-
{
-    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
-    "email": "king.arthur@tintagel.bt",
-    "is_active": true,
-    "is_superuser": false
-}
+
{
+    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
+    "email": "king.arthur@tintagel.bt",
+    "is_active": true,
+    "is_superuser": false
+}
@@ -1882,20 +1898,20 @@

400 Bad Request

Password validation failed.

-
{
-    "detail": {
-        "code": "UPDATE_USER_INVALID_PASSWORD",
-        "reason": "Password should be at least 3 characters"
-    }
-}
+
{
+    "detail": {
+        "code": "UPDATE_USER_INVALID_PASSWORD",
+        "reason": "Password should be at least 3 characters"
+    }
+}

400 Bad Request

A user with this email already exists. -

{
-    "detail": "UPDATE_USER_EMAIL_ALREADY_EXISTS"
-}
+
{
+    "detail": "UPDATE_USER_EMAIL_ALREADY_EXISTS"
+}
@@ -1905,12 +1921,12 @@

Return the user with id user_id.

200 OK

-
{
-    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
-    "email": "king.arthur@camelot.bt",
-    "is_active": true,
-    "is_superuser": false
-}
+
{
+    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
+    "email": "king.arthur@camelot.bt",
+    "is_active": true,
+    "is_superuser": false
+}
@@ -1929,22 +1945,22 @@

Update the user with id user_id.

Payload

-
{
-    "email": "king.arthur@tintagel.bt",
-    "password": "merlin",
-    "is_active": false,
-    "is_superuser": true
-}
+
{
+    "email": "king.arthur@tintagel.bt",
+    "password": "merlin",
+    "is_active": false,
+    "is_superuser": true
+}

200 OK

-
{
-    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
-    "email": "king.arthur@camelot.bt",
-    "is_active": false,
-    "is_superuser": true
-}
+
{
+    "id": "57cbb51a-ab71-4009-8802-3f54b4f2e23",
+    "email": "king.arthur@camelot.bt",
+    "is_active": false,
+    "is_superuser": true
+}
@@ -1962,20 +1978,20 @@

400 Bad Request

Password validation failed.

-
{
-    "detail": {
-        "code": "UPDATE_USER_INVALID_PASSWORD",
-        "reason": "Password should be at least 3 characters"
-    }
-}
+
{
+    "detail": {
+        "code": "UPDATE_USER_INVALID_PASSWORD",
+        "reason": "Password should be at least 3 characters"
+    }
+}

400 Bad Request

A user with this email already exists. -

{
-    "detail": "UPDATE_USER_EMAIL_ALREADY_EXISTS"
-}
+
{
+    "detail": "UPDATE_USER_EMAIL_ALREADY_EXISTS"
+}

DELETE /{user_id}