How do I implement refresh tokens with AuthX?

AuthX supports refresh tokens out of the box; use the auth.create_refresh_token method and validate with dependencies like auth.refresh_token_required. It handles token rotation securely within the dual-token strategy.

AuthX vs FastAPI-JWT-Auth: which should I use?

AuthX offers more built-in features like token freshness and revocation, and is updated for Pydantic 2. FastAPI-JWT-Auth is simpler but less feature-rich. Choose AuthX for comprehensive security or FastAPI-JWT-Auth for minimal, straightforward JWT needs.

Can AuthX handle OAuth2 login with Google or GitHub?

The documentation mentions OAuth2 management, but core features are JWT-based. You likely need to implement OAuth2 flows manually or check the extra package; it's not detailed in the basic README.

How to revoke a JWT token in AuthX?

AuthX provides a token blocklist feature; add tokens to the blocklist to invalidate them. This requires setting up a storage mechanism, potentially using Redis via the authx-extra package for persistence.

Is AuthX suitable for large-scale applications?

With features like token revocation and extensibility, AuthX can scale, but performance depends on your setup. For high loads, consider using the authx-extra package with Redis for efficient session management.

What's the difference between authx and authx-extra?

authx is the core library with JWT authentication, token management, and error handling. authx-extra adds advanced features like Redis session store, HTTP caching, and performance profiling, requiring separate installation.

Open-Awesome

AuthX

MITPython1.7.1

A ready-to-use and customizable authentication and OAuth2 management library for FastAPI applications.

Visit Website GitHub

1.2k stars62 forks0 contributors

What is AuthX?

AuthX is a Python library that provides ready-to-use and customizable authentication and OAuth2 management for FastAPI applications. It solves the problem of implementing secure, production-grade authentication systems by offering features like JWT tokens, refresh tokens, and token revocation out of the box.

Target Audience

FastAPI developers who need to add authentication and authorization to their web applications or APIs without building a custom solution from scratch.

Value Proposition

Developers choose AuthX because it integrates seamlessly with FastAPI, is highly customizable, and includes advanced security features like token freshness and blocklisting, reducing development time and potential security risks.

Overview

Ready-to-use and customizable Authentications and Oauth2 management for FastAPI ✨

Use Cases

Best For

Adding JWT-based authentication to FastAPI backends
Implementing OAuth2 flows in Python web applications
Securing API endpoints with token-based access control
Managing user sessions with access and refresh tokens
Building applications that require token revocation capabilities
Developing FastAPI projects that need customizable authentication error handling

Not Ideal For

Projects not built with the FastAPI web framework
Applications requiring traditional session-based authentication instead of JWT tokens
Teams needing built-in user management interfaces or admin panels out of the box
Simple prototypes where minimal, no-configuration authentication is sufficient

Pros & Cons

Pros

Seamless FastAPI Integration

Designed specifically for FastAPI, it allows easy dependency injection and error handling integration, as shown in the quick start with Depends and handle_errors.

Flexible Token Management

Supports multiple token locations including headers, cookies, query parameters, and JSON body, plus access and refresh tokens for robust session handling.

Enhanced Security Features

Implements token freshness for sensitive operations and token revocation via a blocklist, adding security layers beyond standard JWT.

Extensible Error Handling

Provides customizable error responses for authentication failures, making it adaptable to different API requirements.

Cons

Split Between Core and Extra Features

Advanced functionalities like Redis session store and HTTP caching require installing the separate 'authx-extra' package, complicating dependency management.

JWT-Centric Design

Primarily focuses on JWT authentication, which may not suit projects needing alternative methods like session-based auth without additional customization.

Configuration Overhead

Requires manual setup of configurations such as JWT_SECRET_KEY and token locations, which could be error-prone in rapid prototyping or for beginners.

Frequently Asked Questions

Related Projects

FastAPI Users

Ready-to-use and customizable users management for FastAPI

Stars6,181

Forks508

Last commit9 days ago

FastAPI JWT Auth

FastAPI extension that provides JWT Auth support (secure, easy to use, and lightweight)

Stars828

Forks178

Last commit2 years ago

FastAPI Login

FastAPI-Login tries to provide similar functionality as Flask-Login does.

Stars824

Forks68

Last commit1 year ago

FastAPI Azure Auth

Easy and secure implementation of Azure Entra ID (previously AD) for your FastAPI APIs 🔒 B2C, single- and multi-tenant support.

Stars675

Forks77

Last commit8 months ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub