auth0-fastapi-api

What problem does it solve?

Secure FastAPI API endpoints by validating Auth0-issued access tokens, enforcing scopes and permissions, and supporting DPoP proof-of-possession to prevent token replay and misbound tokens. The guidance reduces common mistakes like hardcoding domain or audience, manual JWT parsing, and incorrect use of ID tokens for API authorization.

Core Features & Use Cases

• Token validation and claims: Verifies issuer, audience, signature via JWKS, and returns decoded claims for use in handlers.
• Scope and permission checks: Enforce required scopes for routes using the require_auth dependency to return 403 on missing scopes.
• DPoP support and proxy handling: Accepts or requires DPoP-bound tokens, includes timing/leeway configuration, and documents proxy trust configuration for correct DPoP validation.
• Use case: Protect a messages API so that only SPA clients with access tokens containing read:messages can retrieve messages while rejecting expired or misbound tokens.

Quick Start

Install the package, set AUTH0_DOMAIN and AUTH0_AUDIENCE in your environment, create an Auth0 API resource, and add an Auth0FastAPI instance with require_auth() to protect your route.