OAuth2 password flow in FastAPI - Step-by-Step Execution

Concept Flow - OAuth2 password flow

User enters username & password

↓

Client sends POST request to /token

↓

Server verifies credentials

↓

Generate access [Return error

User sends username and password to server, server checks them, then returns an access token if valid.

Execution Sample

FastAPI

from fastapi import FastAPI, Depends
from fastapi.security import OAuth2PasswordRequestForm

app = FastAPI()

@app.post('/token')
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    # verify and return token

This code handles the POST request to /token, verifies user credentials, and returns an access token.

Execution Table

Step	Action	Input	Check	Result	Output
1	Receive POST /token	username='alice', password='secret'	None	Request accepted	None
2	Extract credentials	username='alice', password='secret'	None	Credentials extracted	None
3	Verify credentials	Check if 'alice' and 'secret' match	Match found	Credentials valid	None
4	Generate token	User 'alice'	None	Token created	access_token='abc123'
5	Return token response	access_token='abc123'	None	Response sent	{'access_token': 'abc123', 'token_type': 'bearer'}
6	User uses token	Authorization: Bearer abc123	Token valid	Access granted	API data
7	If credentials invalid	username='bob', password='wrong'	No match	Credentials invalid	Error 401 Unauthorized

💡 Execution stops after token is returned or error sent based on credential check.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
username	None	'alice'	'alice'	'alice'	'alice'
password	None	'secret'	'secret'	'secret'	'secret'
credentials_valid	False	False	True	True	True
access_token	None	None	None	'abc123'	'abc123'

Key Moments - 3 Insights

Why does the server return an error instead of a token sometimes?

If the credentials do not match any user (see execution_table step 7), the server returns an error instead of generating a token.

What happens if the password is correct but username is wrong?

The server checks both username and password together (step 3). If either is wrong, credentials are invalid and no token is generated.

When is the access token created?

The token is created only after credentials are verified as valid (step 4). Before that, no token exists.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'credentials_valid' after step 3?

A False

B None

C True

D Error

💡 Hint

Check the 'Result' column at step 3 in the execution_table.

At which step does the server send the access token back to the user?

A Step 5

B Step 4

C Step 2

D Step 6

💡 Hint

Look for the step where 'Response sent' is in the 'Result' column.

If the password is wrong, which step shows the server's response?

A Step 5

B Step 7

C Step 3

D Step 6

💡 Hint

Check the row where 'Credentials invalid' and 'Error 401 Unauthorized' appear.

Concept Snapshot

OAuth2 password flow in FastAPI:
- User sends username & password to /token via POST
- Server verifies credentials
- If valid, server returns access token
- User uses token to access protected API
- If invalid, server returns error
Use OAuth2PasswordRequestForm for input parsing.

Full Transcript

In OAuth2 password flow using FastAPI, the user sends their username and password to the /token endpoint via a POST request. The server extracts these credentials and checks if they match a known user. If the credentials are valid, the server generates an access token and sends it back in the response. The user then uses this token to access protected API routes. If the credentials are invalid, the server returns an error response instead of a token. This flow ensures only authorized users get access tokens to use the API.