Generating JWT Tokens for Authentication

What an amazing progress you've done so far! In previous lessons you learned how to authenticate users using query parameters and how to secure endpoints with dependency injection. While these methods are useful, they have limitations. Specifically, using query parameters to pass credentials is not secure. That's why in this lesson, we will introduce JSON Web Tokens (JWT) as a more secure and efficient way to handle authentication. By the end of this lesson, you will be able to generate JWT tokens and integrate them into your FastAPI application for authentication.

Understanding Bearer Tokens

Before we dive into JWT, let's understand Bearer Tokens . A bearer token is like a "movie ticket" that you present to gain entry. Whoever "bears" this token can access certain resources. Instead of sending your username and password with every request—which is risky—you log in once and receive a bearer token. This token is then included in the headers of future requests to prove your identity. JWT is a type of bearer token. By using tokens, you improve security and efficiency since your credentials are not repeatedly transmitted, and servers can quickly verify token validity.

What is JWT?

JWT stands for JSON Web Token, a compact and URL-safe way to transmit information securely between two parties. These tokens are commonly used in modern web applications to maintain secure communication. Instead of passing login credentials through query parameters—which can be easily intercepted—they provide a safer alternative. A JWT token consists of three parts: a Header, a Payload, and a Signature . The Header contains metadata about the token, such as the type and hashing algorithm used. The Payload carries the actual data or claims, like user information and token expiration time. The Signature ensures the token's integrity by verifying that the content hasn't been tampered with, using a secret key. By encoding this information, JWT protects user data and offers a reliable way to verify user identities.

How Does a Token Look Like?

JWTs are Base64Url encoded, making them compact and URL-safe. Here's an example: text eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0.NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0.NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc Header : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 Payload : eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0 Signature : NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc The payload can contain various claims, such as the user ID and an expiration time ("exp"). The signature ensures that the token hasn't been tampered with.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

text

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0.NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc

Python

from jose import jwt
from datetime import datetime, timedelta

from jose import jwt
from datetime import datetime, timedelta

Python

# Configuration for JWT
SECRET_KEY = "your_secret_key"
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30

# Configuration for JWT
SECRET_KEY = "your_secret_key"
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30

Python

# Function to create JWT token with an expiration time
def create_access_token(data: dict):
    # Copy the provided data to avoid modifying the original
    to_encode = data.copy()
    # Set the token expiration time
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    # Add the expiration time to the token payload
    to_encode.update({"exp": expire})
    # Encode the token with the secret key and algorithm
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)

# Function to create JWT token with an expiration time
def create_access_token(data: dict):
    # Copy the provided data to avoid modifying the original
    to_encode = data.copy()
    # Set the token expiration time
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    # Add the expiration time to the token payload
    to_encode.update({"exp": expire})
    # Encode the token with the secret key and algorithm
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)

Python

from fastapi import FastAPI

app = FastAPI()

# Mock database with usernames and passwords
users_db = {"user1": "pass1", "user2": "pass2"}

from fastapi import FastAPI

app = FastAPI()

# Mock database with usernames and passwords
users_db = {"user1": "pass1", "user2": "pass2"}

Python

from fastapi import HTTPException, Depends
from fastapi.security import OAuth2PasswordRequestForm

# Function to check if user exists in the database
def authenticate_user(form_data: OAuth2PasswordRequestForm = Depends()):
    username = form_data.username
    password = form_data.password
    if users_db.get(username) == password:
        return {"username": username}
    raise HTTPException(status_code=401, detail="Incorrect username or password")

from fastapi import HTTPException, Depends
from fastapi.security import OAuth2PasswordRequestForm

# Function to check if user exists in the database
def authenticate_user(form_data: OAuth2PasswordRequestForm = Depends()):
    username = form_data.username
    password = form_data.password
    if users_db.get(username) == password:
        return {"username": username}
    raise HTTPException(status_code=401, detail="Incorrect username or password")

Python

from pydantic import BaseModel

# Token class
class Token(BaseModel):
    access_token: str
    token_type: str

from pydantic import BaseModel

# Token class
class Token(BaseModel):
    access_token: str
    token_type: str

Python

from fastapi import FastAPI, HTTPException, Depends
from fastapi.security import OAuth2PasswordRequestForm

# Login endpoint
@app.post("/login", response_model=Token)
async def login_for_access_token(form_data: OAuth2PasswordRequestForm = Depends()):
    # Check username and password in the database
    user = authenticate_user(form_data)
    # Create an access token
    access_token = create_access_token(data={"sub": user["username"]})
    # Return the access token 
    return {"access_token": access_token, "token_type": "bearer"}

from fastapi import FastAPI, HTTPException, Depends
from fastapi.security import OAuth2PasswordRequestForm

# Login endpoint
@app.post("/login", response_model=Token)
async def login_for_access_token(form_data: OAuth2PasswordRequestForm = Depends()):
    # Check username and password in the database
    user = authenticate_user(form_data)
    # Create an access token
    access_token = create_access_token(data={"sub": user["username"]})
    # Return the access token 
    return {"access_token": access_token, "token_type": "bearer"}

JSON

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0.NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc",
    "token_type": "bearer"
}

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0.NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc",
    "token_type": "bearer"
}

Python

from jose import jwt
from datetime import datetime, timedelta

Python

# Configuration for JWT
SECRET_KEY = "your_secret_key"
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30

Python

# Function to create JWT token with an expiration time
def create_access_token(data: dict):
    # Copy the provided data to avoid modifying the original
    to_encode = data.copy()
    # Set the token expiration time
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    # Add the expiration time to the token payload
    to_encode.update({"exp": expire})
    # Encode the token with the secret key and algorithm
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)

Python

from fastapi import FastAPI

app = FastAPI()

# Mock database with usernames and passwords
users_db = {"user1": "pass1", "user2": "pass2"}

Python

from fastapi import HTTPException, Depends
from fastapi.security import OAuth2PasswordRequestForm

# Function to check if user exists in the database
def authenticate_user(form_data: OAuth2PasswordRequestForm = Depends()):
    username = form_data.username
    password = form_data.password
    if users_db.get(username) == password:
        return {"username": username}
    raise HTTPException(status_code=401, detail="Incorrect username or password")

Python

from pydantic import BaseModel

# Token class
class Token(BaseModel):
    access_token: str
    token_type: str

Python

from fastapi import FastAPI, HTTPException, Depends
from fastapi.security import OAuth2PasswordRequestForm

# Login endpoint
@app.post("/login", response_model=Token)
async def login_for_access_token(form_data: OAuth2PasswordRequestForm = Depends()):
    # Check username and password in the database
    user = authenticate_user(form_data)
    # Create an access token
    access_token = create_access_token(data={"sub": user["username"]})
    # Return the access token 
    return {"access_token": access_token, "token_type": "bearer"}

JSON

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTcyMjU0MTEzOX0.NVgxSDjgt1Yh27qvlfxI1YNW5eEqOt4OTrTawb5bMUc",
    "token_type": "bearer"
}

Generating JWT Tokens for Authentication

Understanding Bearer Tokens

What is JWT?

How Does a Token Look Like?

Join the 1M+ learners on CodeSignal

Importing Essential Modules

Configuring JWT Settings

Creating the JWT Token

Setup Recap

Updated Authentication Function

Creating the Token Response Model

Implementing the Login Endpoint

Expected Response

Summary and Practices