JWT token verification in FastAPI - Mini Project: Build & Apply

JWT Token Verification with FastAPI

📖 Scenario: You are building a simple API that needs to check if a user is allowed access by verifying a JWT token sent with the request.This is like checking a ticket at a concert entrance to make sure it is valid before letting someone in.

🎯 Goal: Build a FastAPI app that verifies a JWT token from the request header and allows access only if the token is valid.

📋 What You'll Learn

Create a secret key variable for signing tokens

Create a function to decode and verify the JWT token

Use FastAPI dependency injection to check the token on a protected route

Return a success message if the token is valid

💡 Why This Matters

🌍 Real World

APIs often need to verify user identity securely using JWT tokens to protect sensitive data and actions.

💼 Career

Understanding JWT token verification is essential for backend developers working with modern web APIs and authentication.

1

Set up the secret key

Create a variable called SECRET_KEY and set it to the string "mysecretkey123".

FastAPI

# Your code here

Need a hint?

The secret key is like a password used to sign and check tokens.

2

Create a function to verify the JWT token

Write a function called verify_token that takes a parameter token. Inside, use jwt.decode(token, SECRET_KEY, algorithms=["HS256"]) to decode the token and return the decoded data.

FastAPI

SECRET_KEY = "mysecretkey123"
# Your code here

Need a hint?

Use the jose library's jwt.decode to check the token. Handle errors with a try-except block.

3

Add a FastAPI dependency to check the token

Import Depends and HTTPException from fastapi. Create a function called get_current_user that takes token: str = Depends(). Inside, call verify_token(token). If it returns None, raise HTTPException(status_code=401, detail="Invalid token"). Otherwise, return the decoded token data.

FastAPI

SECRET_KEY = "mysecretkey123"

from jose import jwt, JWTError
from fastapi import Depends, HTTPException

# Your code here

Need a hint?

Use FastAPI's Depends to get the token automatically from the request.

4

Create a protected route using the token verification

Import FastAPI. Create an app instance called app. Add a route @app.get("/protected") that uses get_current_user as a dependency. The route function should return a dictionary with {"message": "Access granted", "user": user} where user is the decoded token data.

FastAPI

SECRET_KEY = "mysecretkey123"

from jose import jwt, JWTError
from fastapi import Depends, HTTPException, FastAPI

# Your code here

Need a hint?

The route uses the get_current_user dependency to check the token before allowing access.