Bearer token handling in FastAPI - Mini Project: Build & Apply

Bearer Token Handling with FastAPI

📖 Scenario: You are building a simple API that requires users to provide a bearer token to access protected data. This is common in real-world apps where security matters, like accessing your bank info or private messages.

🎯 Goal: Create a FastAPI app that checks for a bearer token in the request header and allows access only if the token matches a preset secret token.

📋 What You'll Learn

Create a FastAPI app instance called app

Define a secret token string variable called SECRET_TOKEN with value "mysecrettoken123"

Create a dependency function called verify_token that extracts the bearer token from the Authorization header

Check if the token matches SECRET_TOKEN and raise HTTPException with status 401 if it does not

Create a GET endpoint /protected that uses verify_token as a dependency and returns a JSON message {"message": "Access granted"}

💡 Why This Matters

🌍 Real World

APIs often require secure access control using bearer tokens to protect user data and resources.

💼 Career

Understanding bearer token handling is essential for backend developers working on secure web services and APIs.

1

Create FastAPI app and secret token

Import FastAPI from fastapi. Create a FastAPI app instance called app. Create a string variable called SECRET_TOKEN and set it to "mysecrettoken123".

FastAPI

from fastapi import FastAPI

# Your code here

Hint

Remember to import FastAPI first, then create the app and the secret token variable exactly as named.

2

Create token verification dependency

Import Depends, HTTPException, and status from fastapi. Import Header from fastapi. Define a function called verify_token that takes authorization: str | None = Header(default=None). Inside, check if authorization is None or does not start with "Bearer ". If so, raise HTTPException with status code status.HTTP_401_UNAUTHORIZED and detail "Invalid or missing token". Extract the token string after "Bearer " and check if it equals SECRET_TOKEN. If not, raise the same HTTPException. Return True if token is valid.

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status, Header

app = FastAPI()
SECRET_TOKEN = "mysecrettoken123"

# Your code here

Hint

Use the Header parameter to get the Authorization header. Check for the 'Bearer ' prefix and compare the token to SECRET_TOKEN.

3

Create protected GET endpoint

Create a GET endpoint /protected using @app.get("/protected"). Add a parameter token: bool = Depends(verify_token) to use the token verification dependency. Return a dictionary {"message": "Access granted"} from the endpoint function.

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status, Header

app = FastAPI()
SECRET_TOKEN = "mysecrettoken123"

def verify_token(authorization: str | None = Header(default=None)):
    if authorization is None or not authorization.startswith("Bearer "):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or missing token")
    token = authorization[7:]
    if token != SECRET_TOKEN:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or missing token")
    return True

# Create GET endpoint /protected using verify_token dependency
# Your code here

Hint

Use Depends to call verify_token in the endpoint parameters. Return the success message as a dictionary.

4

Add CORS middleware for cross-origin requests

Import CORSMiddleware from fastapi.middleware.cors. Add CORS middleware to app with allow_origins=["*"], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. This enables the API to be accessed from any website during development.

FastAPI

from fastapi import FastAPI, Depends, HTTPException, status, Header
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()
SECRET_TOKEN = "mysecrettoken123"

def verify_token(authorization: str | None = Header(default=None)):
    if authorization is None or not authorization.startswith("Bearer "):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or missing token")
    token = authorization[7:]
    if token != SECRET_TOKEN:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or missing token")
    return True

@app.get("/protected")
def protected_route(token: bool = Depends(verify_token)):
    return {"message": "Access granted"}

# Add CORS middleware to app
# Your code here

Hint

Use app.add_middleware with CORSMiddleware and set all allow options to "*" or True as shown.

Practice

1. What is the main purpose of using a Bearer token in FastAPI?

easy

A. To serve static files efficiently

B. To format JSON responses automatically

C. To speed up database queries

D. To securely identify and authorize API requests

Solution

1. Step 1: Understand Bearer token role

   Bearer tokens are used to prove the client has permission to access protected routes.

2. Step 2: Identify purpose in FastAPI

   FastAPI uses Bearer tokens to check authorization before allowing access to API endpoints.

3. Final Answer:

   To securely identify and authorize API requests -> Option D

4. Quick Check:

   Bearer token = Authorization [OK]

Hint: Bearer tokens are for security and access control [OK]

Common Mistakes:

• Confusing token with response formatting
• Thinking token speeds up database
• Assuming token serves static files

2. Which FastAPI class is used to extract a Bearer token from the Authorization header?

easy

A. OAuth2PasswordBearer

B. HTTPBasicCredentials

C. OAuth2PasswordRequestForm

D. APIKeyHeader

Solution

1. Step 1: Recall FastAPI token extraction classes

   OAuth2PasswordBearer is designed to read Bearer tokens from the Authorization header.

2. Step 2: Match class to Bearer token usage

   OAuth2PasswordRequestForm is for form data, HTTPBasicCredentials is for basic auth, APIKeyHeader is for API keys, so only OAuth2PasswordBearer fits Bearer tokens.

3. Final Answer:

   OAuth2PasswordBearer -> Option A

4. Quick Check:

   Bearer token extractor = OAuth2PasswordBearer [OK]

Hint: Bearer token uses OAuth2PasswordBearer class [OK]

Common Mistakes:

• Using OAuth2PasswordRequestForm for token extraction
• Confusing basic auth with Bearer token
• Choosing APIKeyHeader for Bearer tokens

3. Given this FastAPI dependency:

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

@app.get("/users/me")
async def read_users_me(token: str = Depends(oauth2_scheme)):
    return {"token": token}

What will be the output if the client sends a request with header Authorization: Bearer abc123?

medium

A. {"token": "Bearer abc123"}

B. HTTP 401 Unauthorized error

C. {"token": "abc123"}

D. {"token": null}

Solution

1. Step 1: Understand OAuth2PasswordBearer behavior

   This class extracts only the token string after 'Bearer ' from the Authorization header.

2. Step 2: Analyze the returned value

   The function returns a JSON with the token string, so it will return {"token": "abc123"}.

3. Final Answer:

   {"token": "abc123"} -> Option C

4. Quick Check:

   Bearer token string extracted = "abc123" [OK]

Hint: OAuth2PasswordBearer strips 'Bearer ' prefix automatically [OK]

Common Mistakes:

• Expecting full 'Bearer abc123' string returned
• Assuming 401 error without token validation
• Thinking token is null if present

4. What is wrong with this FastAPI code snippet for Bearer token validation?

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

@app.get("/items/")
async def read_items(token: str = Depends(oauth2_scheme)):
    if token == None:
        raise HTTPException(status_code=401, detail="Invalid token")
    return {"token": token}

medium

A. The token check should use 'if not token' instead of 'if token == None'

B. OAuth2PasswordBearer does not extract tokens from headers

C. The route path should not end with a slash

D. HTTPException requires a status_code of 403 for invalid tokens

Solution

1. Step 1: Check token validation logic

   OAuth2PasswordBearer returns a string or raises an error if missing; token is never None but can be empty or missing.

2. Step 2: Correct token presence check

   Using 'if not token' is safer to catch empty strings or missing tokens rather than 'token == None'.

3. Final Answer:

   The token check should use 'if not token' instead of 'if token == None' -> Option A

4. Quick Check:

   Token presence check = 'if not token' [OK]

Hint: Check token presence with 'if not token' for safety [OK]

Common Mistakes:

• Using 'token == None' which misses empty strings
• Thinking OAuth2PasswordBearer doesn't extract tokens
• Confusing HTTP status codes for auth errors

5. You want to protect a FastAPI route so only requests with the exact Bearer token "secret123" are allowed. Which code snippet correctly implements this?

hard

A. async def protected_route(token: str = Depends(oauth2_scheme)):
if token == None:
return {"message": "Access granted"}
raise HTTPException(status_code=401, detail="Unauthorized")

B. async def protected_route(token: str = Depends(oauth2_scheme)):
if token != "secret123":
raise HTTPException(status_code=401, detail="Unauthorized")
return {"message": "Access granted"}

C. async def protected_route(token: str):
if token == "secret123":
return {"message": "Access granted"}
raise HTTPException(status_code=403, detail="Forbidden")

D. async def protected_route(token: str = Depends(oauth2_scheme)):
if token == "Bearer secret123":
return {"message": "Access granted"}
raise HTTPException(status_code=401, detail="Unauthorized")

Solution

1. Step 1: Use OAuth2PasswordBearer dependency

   We must use Depends(oauth2_scheme) to extract the token from the Authorization header.

2. Step 2: Check token value correctly

   The token string is just the token without 'Bearer ' prefix, so compare directly to "secret123" and raise 401 if not matching.

3. Final Answer:

   async def protected_route(token: str = Depends(oauth2_scheme)): if token != "secret123": raise HTTPException(status_code=401, detail="Unauthorized") return {"message": "Access granted"} -> Option B

4. Quick Check:

   Compare token string directly to "secret123" [OK]

Hint: Compare token string directly, no 'Bearer ' prefix included [OK]

Common Mistakes:

• Comparing token to 'Bearer secret123' including prefix
• Not using Depends(oauth2_scheme) to get token
• Returning access granted when token is None