authentication

JWT authentication generates secure tokens for stateless user verification. Create tokens with user identity and roles, validate them on protected endpoints using FastAPI dependencies, and reject expired or tampered tokens. This approach eliminates server-side session storage while maintaining security.

Role-based access control (RBAC) restricts endpoint access by user role. Define roles and permissions, embed them in JWT tokens, then enforce them via dependency injection on routes. FastAPI's dependency system lets you create reusable authorization checks that verify user roles before executing handlers.

OAuth2 integration offloads authentication to third-party providers. Use authlib to handle OAuth2 flows with Google and GitHub, exchanging authorization codes for access tokens and user profile data. This reduces credential management burden while leveraging trusted identity providers.

Password hashing converts plaintext passwords into irreversible strings using passlib. Hash passwords during registration, then verify user input against stored hashes during login. This approach protects credentials if your database is compromised.

Redis is optional but recommended for session storage at scale. It provides fast, persistent session tracking across application instances and enables session invalidation on logout. For single-instance applications with low concurrency, in-memory storage may suffice.

JWT tokens cannot be revoked until expiration, making immediate logout difficult. Token payload size grows with additional claims, and you cannot store frequently changing data like permissions. Session-based approaches work better when real-time permission updates or instant logout is critical.