Testing authentication in FastAPI - Step-by-Step Execution

Concept Flow - Testing authentication

Start Test Setup

↓

Create Test Client

↓

Send Auth Request

↓

Check Response Status

↓

Verify Token

↓

End Test

This flow shows how a test client sends an authentication request, checks the response, and verifies the token if successful.

Execution Sample

FastAPI

from fastapi.testclient import TestClient
from main import app
client = TestClient(app)
def test_login():
    response = client.post('/login', json={'username':'user','password':'pass'})
    assert response.status_code == 200

This code tests the login endpoint by sending a POST request with credentials and checks if the response status is 200 (OK).

Execution Table

Step	Action	Request Data	Response Status	Response Body	Assertion
1	Create TestClient	N/A	N/A	N/A	N/A
2	Send POST /login	{'username':'user','password':'pass'}	200	{"access_token": "abc123", "token_type": "bearer"}	Check status_code == 200
3	Verify token in response	N/A	N/A	access_token present	Pass
4	Test ends	N/A	N/A	N/A	Test passed

💡 Test ends after verifying response status and token presence

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
client	None	TestClient instance	TestClient instance	TestClient instance
response	None	Response object with status 200	Response object with token	Response object with token
token	None	None	"abc123"	"abc123"

Key Moments - 2 Insights

Why do we check response.status_code before accessing the token?

Because if the status code is not 200, the response may not contain a token. Checking status_code first avoids errors and confirms the request succeeded (see execution_table step 2).

What happens if the credentials are wrong?

The response.status_code would not be 200, likely 401 or 403, so the test would fail at the assertion in step 2, stopping before token verification.

Visual Quiz - 3 Questions

Look at the execution table, what is the response status after sending the POST request?

A 500

B 200

C 401

D 404

💡 Hint

Check the 'Response Status' column at step 2 in the execution_table.

At which step do we confirm the token is present in the response?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Action' and 'Assertion' columns in the execution_table.

If the password was incorrect, how would the assertion in step 2 change?

A It would fail because status_code would not be 200

B It would still pass because status_code is always 200

C It would pass but token would be missing

D It would raise an exception before assertion

💡 Hint

Refer to key_moments about wrong credentials and step 2 assertion.

Concept Snapshot

Testing authentication in FastAPI:
- Use TestClient to simulate requests
- Send POST with credentials to /login
- Check response.status_code == 200
- Verify access_token in response JSON
- Fail test if status or token missing

Full Transcript

This visual execution shows how to test authentication in FastAPI using TestClient. First, the test client is created. Then, a POST request is sent to the login endpoint with username and password. The response status code is checked to be 200, meaning success. Next, the test verifies that the response contains an access token. If all checks pass, the test ends successfully. If credentials are wrong, the status code would differ and the test would fail early. This step-by-step trace helps beginners understand how authentication tests run and what to check.