better-auth-python

JWT verification in FastAPI involves fetching public keys from Better Auth's JWKS endpoint, validating token signatures with RS256, and extracting user identity. This Skill provides JWKS caching, Bearer token parsing, and a get_current_user dependency to protect routes and enforce authenticated user context across your application.

Yes. This Skill demonstrates integration patterns for scoping database queries by authenticated user identity. After validating the JWT, you extract the user ID from the token and use it to filter SQLModel or SQLAlchemy queries, ensuring each user accesses only their own data.

Use a FastAPI dependency that validates incoming Bearer tokens against the Better Auth JWKS endpoint before route execution. This Skill provides a ready-to-wire get_current_user dependency that performs signature validation, caches public keys, and returns the authenticated user for downstream use.

JWKS validation fetches the server's public key set once and caches it, then uses those keys to verify each token's RS256 signature without calling the auth server repeatedly. FastAPI dependencies intercept requests, decode and validate the Bearer token, and pass the user context to your route handlers.

This Skill focuses on validating tokens at request time using JWT decode and expiration checks. Token refresh logic remains your responsibility; the Skill ensures expired or invalid tokens are rejected before your route executes.

The Skill implements JWKS caching to serve previously fetched keys if the endpoint becomes temporarily unreachable. However, during cache miss or server restart, availability of the JWKS endpoint is required to validate new tokens; consider retry and fallback strategies for production resilience.