authentication-setup

JWT authentication in FastAPI uses access and refresh tokens for secure user sessions. Create endpoints that issue tokens on login, validate them on protected routes, and refresh expired access tokens using the refresh token. This Skill provides the complete implementation including token generation, validation, and session management.

Bcrypt is the recommended password hashing library for FastAPI. It applies salted hashing to store passwords irreversibly and provides verification during login. This Skill implements bcrypt hashing with strength validation to ensure passwords meet security requirements before storage.

Account lockout policies block further login attempts after a threshold of failures, preventing brute-force credential guessing. This Skill enforces automatic lockout mechanisms that require time-based or manual account resets, protecting against repeated unauthorized access attempts.

Password reset flows use secure, time-limited tokens sent via email to verify user identity before allowing password changes. This Skill provides the complete password reset implementation, including token generation, validation, and secure password update endpoints.

JWT tokens can encode user roles and permissions, enabling role-based access control for admin operations. This Skill secures admin endpoints by decoding tokens and validating user authorization before executing privileged actions like user management.

Access tokens are short-lived credentials used for API requests, while refresh tokens are long-lived credentials used only to obtain new access tokens. This approach limits exposure if an access token is compromised. This Skill implements both token types with appropriate expiration and validation.