JWT token creation in FastAPI - Step-by-Step Execution

Concept Flow - JWT token creation

Start

↓

Prepare payload data

↓

Encode payload with secret key and algorithm

↓

Generate JWT token string

↓

Return token to user

↓

End

This flow shows how a JWT token is created by preparing data, encoding it with a secret, and returning the token string.

Execution Sample

FastAPI

from jose import jwt

def create_token(data: dict, secret: str):
    token = jwt.encode(data, secret, algorithm="HS256")
    return token

This function creates a JWT token by encoding the given data dictionary with a secret key using HS256 algorithm.

Execution Table

Step	Action	Input	Process	Output
1	Receive data and secret	{"user_id": 123}, "mysecret"	Ready to encode	Ready to encode
2	Encode data	{"user_id": 123}, "mysecret"	jwt.encode called with HS256	JWT token string generated
3	Return token	JWT token string	Function returns token	Token string returned to caller
4	End	-	-	-

💡 Token creation completes after encoding and returning the JWT string.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
data	{}	{"user_id": 123}	{"user_id": 123}	{"user_id": 123}
secret	""	"mysecret"	"mysecret"	"mysecret"
token	None	None	"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."	"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Key Moments - 2 Insights

Why do we need a secret key when creating a JWT token?

The secret key is used to encode the token securely so that only parties with the secret can verify or create valid tokens, as shown in step 2 of the execution_table.

What does the 'algorithm' parameter do in jwt.encode?

It specifies the method to encode the token. HS256 means HMAC with SHA-256, which ensures token integrity, as seen in the process column of step 2.

Visual Quiz - 3 Questions

Look at the execution_table, what is the output after step 2?

A Ready to encode

B Function returns token

C JWT token string generated

D None

💡 Hint

Check the Output column in row with Step 2 in execution_table.

At which step is the token variable assigned a value?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at variable_tracker for 'token' changes after Step 2.

If the secret key changes, which part of the execution_table is affected?

A Step 1 Input

B Step 2 Process

C Step 3 Output

D Step 4

💡 Hint

The secret key is used during encoding, see Step 2 Process in execution_table.

Concept Snapshot

JWT token creation in FastAPI:
- Prepare payload data as a dict
- Use jwt.encode(data, secret, algorithm="HS256")
- Secret key secures the token
- Returns a string token
- Token can be sent to clients for authentication

Full Transcript

This visual trace shows how a JWT token is created in FastAPI. First, the function receives the data dictionary and secret key. Then it calls jwt.encode with the HS256 algorithm to securely encode the data into a token string. The token variable stores this string. Finally, the function returns the token to the caller. The secret key is essential to ensure only authorized parties can create or verify tokens. The algorithm parameter defines the encoding method. The token string can then be used for user authentication in web applications.

Practice

1. What is the main purpose of creating a JWT token in FastAPI?

easy

A. To style the user interface

B. To send emails automatically

C. To connect to a database

D. To securely store user information for authentication

Solution

1. Step 1: Understand JWT token purpose

   JWT tokens are used to safely carry user data for authentication.

2. Step 2: Identify correct use in FastAPI

   FastAPI uses JWT tokens to verify user identity securely.

3. Final Answer:

   To securely store user information for authentication -> Option D

4. Quick Check:

   JWT purpose = secure user info [OK]

Hint: JWT tokens are for secure user identity, not UI or DB [OK]

Common Mistakes:

• Confusing JWT with UI styling or database connection
• Thinking JWT sends emails
• Assuming JWT stores passwords directly

2. Which of the following is the correct way to import the function to create JWT tokens in FastAPI using PyJWT?

easy

A. import jwt.encode

B. from fastapi import jwt_encode

C. from jwt import encode

D. from fastapi.security import create_jwt

Solution

1. Step 1: Identify the JWT library used

   PyJWT is commonly used and provides an encode function imported as 'from jwt import encode'.

2. Step 2: Check FastAPI imports

   FastAPI itself does not provide jwt_encode or create_jwt functions directly.

3. Final Answer:

   from jwt import encode -> Option C

4. Quick Check:

   PyJWT encode import = from jwt import encode [OK]

Hint: PyJWT encode is imported from jwt, not fastapi [OK]

Common Mistakes:

• Trying to import JWT functions directly from FastAPI
• Using incorrect import syntax
• Confusing module names

3. Given this code snippet, what will be the output of the print(token) statement?

from jwt import encode

payload = {"user_id": 123}
secret = "mysecret"
algorithm = "HS256"
token = encode(payload, secret, algorithm=algorithm)
print(token)

medium

A. A JWT token string encoded with user_id 123

B. An error because algorithm parameter is missing

C. The original payload dictionary printed

D. None, because encode returns nothing

Solution

1. Step 1: Understand encode function behavior

   The encode function creates a JWT token string from the payload using the secret and algorithm.

2. Step 2: Analyze the code snippet

   Payload and secret are provided correctly, algorithm is set to HS256, so encode returns a JWT token string.

3. Final Answer:

   A JWT token string encoded with user_id 123 -> Option A

4. Quick Check:

   encode returns JWT string [OK]

Hint: encode returns a token string, not the original data [OK]

Common Mistakes:

• Expecting encode to print the payload
• Missing algorithm causes error (not true here)
• Thinking encode returns None

4. Identify the error in this JWT token creation code snippet:

from jwt import encode

payload = {"user_id": 42}
secret = "secretkey"
token = encode(payload, secret)
print(token)

medium

A. Missing algorithm parameter causes an error

B. No error; code runs correctly

C. Secret key should be bytes, not string

D. Payload must be a string, not a dictionary

Solution

1. Step 1: Check encode function requirements

   PyJWT's encode has a default algorithm='HS256', so it is not strictly required.

2. Step 2: Analyze the code snippet

   The code calls encode with payload and secret; algorithm defaults to HS256, so it runs correctly and produces a token.

3. Final Answer:

   No error; code runs correctly -> Option B

4. Quick Check:

   Algorithm defaults to HS256 = no error [OK]

Hint: PyJWT encode defaults to HS256 algorithm [OK]

Common Mistakes:

• Assuming algorithm defaults to HS256
• Thinking payload must be string
• Believing secret must be bytes

5. You want to create a JWT token in FastAPI that expires in 30 minutes. Which code snippet correctly adds the expiration time to the payload before encoding?

hard

A. payload = {"user_id": 1, "exp": datetime.utcnow() + timedelta(minutes=30)}

B. payload = {"user_id": 1, "exp": str(datetime.utcnow() + timedelta(minutes=30))}

C. payload = {"user_id": 1, "exp": time.time() + 1800}

D. payload = {"user_id": 1, "exp": datetime.now() + timedelta(minutes=30)}

Solution

1. Step 1: Understand JWT expiration format

   The 'exp' claim must be a UTC datetime or a timestamp representing expiration time.

2. Step 2: Evaluate each option

   payload = {"user_id": 1, "exp": datetime.utcnow() + timedelta(minutes=30)} uses datetime.utcnow() + timedelta for 30 minutes, which is correct. payload = {"user_id": 1, "exp": str(datetime.utcnow() + timedelta(minutes=30))} converts datetime to string, which is invalid. payload = {"user_id": 1, "exp": time.time() + 1800} uses time.time() but JWT expects datetime or timestamp as int, so this may cause issues. payload = {"user_id": 1, "exp": datetime.now() + timedelta(minutes=30)} uses datetime.now() which is local time, not UTC, causing potential errors.

3. Final Answer:

   payload = {"user_id": 1, "exp": datetime.utcnow() + timedelta(minutes=30)} -> Option A

4. Quick Check:

   Use UTC datetime for 'exp' claim [OK]

Hint: Use datetime.utcnow() + timedelta for expiration [OK]

Common Mistakes:

• Using local time instead of UTC
• Converting datetime to string for 'exp'
• Using wrong time functions like time.time() without conversion