FastAuth
A FastAPI-native authentication library inspired by Better Auth. It gives FastAPI apps session, JWT, OIDC and OAuth2 authentication out of the box, with an adapter layer for ORMs. ...
Description
FastAuth brings Better Auth-style developer experience to FastAPI — and it is FastAPI-only on purpose, so it can lean on FastAPI dependencies, Pydantic validation, and async end to end instead of abstracting over them. One class per strategy, one frozen config object, and your own SQLAlchemy models for storage. It mounts a ready-made router (signup, login, logout, forgot/reset password, me) and protects routes through an auth.current_user dependency. Secure defaults ship out of the box — placeholder secrets are rejected and bad config fails at startup — while adapters, hooks, and rate-limit backends keep it pluggable underneath.
Features
- Session strategy with HttpOnly, Secure and SameSite cookies, server-side expiry, and rotation on login.
- JWT strategy with short-lived access tokens and single-use rotating refresh tokens with reuse detection.
- OIDC login with provider discovery documents, state CSRF protection, and id_token signature, issuer, audience and expiry verification.
- Plain OAuth2 login for providers without discovery documents.
- Pluggable storage adapters — SQLAlchemy included, bring your own ORM by subclassing the Adapter base.
- Event hooks across signup, login, logout, refresh, password reset, and OAuth logins; before-hooks can modify or abort requests, observers never break responses.
- Fixed-window rate limiting per IP and path, with in-memory, database, or Redis backends.
- Passwords handled as SecretStr with generic login-failure errors.