Skip to content

10. Authentication

The API is currently wide open. Anyone with the URL can create projects, change task status, and delete data.

We'll add some password-based authentication: users sign up, log in, and receive a JWT they include with every authenticated request.

  • Introduction: the difference between authentication and authorization
  • Password Hashing: how to handle hashes passwords withpwdlib (Argon2id under the hood)
  • JSON Web Tokens: what's in a JWT, why their signature is what makes it tamper-evident, and how to make one with PyJWT.
  • Protecting Endpoints: wiring OAuth2PasswordBearer and a get_current_user dependency, plus a CurrentUserDep alias to drop into route signatures.
  • Exercise: fill in the password-hash and token-generation helpers, the login endpoint body, and protect the right routes.