FastAPI JWT Authentication in 2026: A Complete Login API in One File (Argon2 + PyJWT, Tested)

Most FastAPI auth tutorials stop at "it returns a token". This one goes further: one file, 118 lines, five endpoints, and every response below comes from actually running it, including the failure cases most guides skip: no token, wrong password, a tampered token and an expired one.

I build it line by line in this video:

Tested with: Python 3.12 · FastAPI 0.128 · PyJWT 2.15 · pwdlib 0.2 (Argon2) · Pydantic 2.13 · Uvicorn 0.39.

What you'll build

Endpoint	What it does
`GET /`	Root message and a link to the docs
`GET /health`	Health check
`POST /token`	Log in with username and password and get a JWT
`GET /me`	Returns the logged-in user (token required)
`GET /protected`	Example of a guarded route (token required)

The flow: the client sends a username and password to /token, gets back a signed JWT, then sends it as Authorization: Bearer <token> on every protected request. One dependency, get_current_user(), does all the checking, so protecting a new route is a single line.

1. Install

requirements.txt:

fastapi>=0.115.0 uvicorn[standard]>=0.30.0 pyjwt>=2.9.0 pwdlib[argon2]>=0.2.0 python-multipart>=0.0.9 python-dotenv>=1.0.1

python3.12 -m venv .venv && source .venv/bin/activate pip install -r requirements.txt

PyJWT signs and verifies tokens. (FastAPI's docs moved from python-jose to PyJWT.)
pwdlib[argon2] hashes passwords with Argon2, the modern replacement for passlib.
python-multipart is needed because the login endpoint reads an HTML-style form.

Use Python 3.10 or newer: the code uses str | None type hints, which Pydantic rejects on 3.9.

2. Config: secret, algorithm, expiry

load_dotenv() app = FastAPI(title="FastAPI JWT Authentication", version="1.0.0") JWT_SECRET = os.getenv("JWT_SECRET", "dev-only-secret-change-me") ALGORITHM = "HS256" ACCESS_TOKEN_EXPIRE_MINUTES = 30 password_hash = PasswordHash.recommended() oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

PasswordHash.recommended() picks Argon2. OAuth2PasswordBearer(tokenUrl="token") tells FastAPI where tokens come from. It also powers the Authorize button in Swagger UI.

Generate a real secret and put it in .env. More on why below:

python -c "import secrets; print(secrets.token_urlsafe(32))"

JWT_SECRET=paste-the-output-here

3. Users, models and password checks

For the demo, users live in a dict, and the password is hashed when the app starts, so no plain-text password is ever stored:

DEMO_USERS = { "demo": { "username": "demo", "full_name": "Demo User", "hashed_password": password_hash.hash("demo123"), } } class Token(BaseModel): access_token: str token_type: str class User(BaseModel): username: str full_name: str | None = None def authenticate_user(username: str, password: str) -> User | None: record = DEMO_USERS.get(username) if record is None: return None if not password_hash.verify(password, record["hashed_password"]): return None return get_user(username)

Notice that User has no password field. Because the routes declare response_model=User, the hash can never leak into a response by accident.

4. Creating the token

def create_access_token(data: dict, expires: timedelta | None = None) -> str: payload = data.copy() if expires is None: expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES) payload["exp"] = datetime.now(timezone.utc) + expires return jwt.encode(payload, JWT_SECRET, algorithm=ALGORITHM)

Use datetime.now(timezone.utc), not the deprecated utcnow(). PyJWT checks exp for you when it decodes.

5. The dependency that guards every route

async def get_current_user(token: Annotated[str, Depends(oauth2_scheme)]) -> User: error = HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate credentials", headers={"WWW-Authenticate": "Bearer"}, ) try: payload = jwt.decode(token, JWT_SECRET, algorithms=[ALGORITHM]) except InvalidTokenError: raise error username = payload.get("sub") if username is None: raise error user = get_user(username) if user is None: raise error return user

Two details matter here:

algorithms=[ALGORITHM] is a list you pass explicitly. Never let the token's own header decide the algorithm.
Every failure returns the same 401. A bad signature, an expired token and an unknown user all look identical to the client, which gives attackers nothing to learn from.

6. The endpoints

@app.post("/token", response_model=Token) async def login(form: Annotated[OAuth2PasswordRequestForm, Depends()]): user = authenticate_user(form.username, form.password) if user is None: raise HTTPException(status_code=401, detail="Incorrect username or password") token = create_access_token({"sub": user.username}) return Token(access_token=token, token_type="bearer") @app.get("/me", response_model=User) async def read_me(user: Annotated[User, Depends(get_current_user)]): return user @app.get("/protected") async def protected(user: Annotated[User, Depends(get_current_user)]): return { "message": f"Hello {user.username}, your JWT is valid.", "framework": "FastAPI", "language": "Python", }

To protect any new route, add user: Annotated[User, Depends(get_current_user)] to its parameters. That's the whole pattern.

7. Run it

uvicorn app:app --reload

Open http://127.0.0.1:8000/docs, click Authorize, and log in with demo / demo123. Or test it with curl, as I did below.

8. Real test results: the happy path

curl -X POST http://127.0.0.1:8000/token -d "username=demo&password=demo123"

{"access_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW...","token_type":"bearer"}

A JWT is three base64url parts separated by dots: header, payload, signature. Decoding the first two:

{"alg":"HS256","typ":"JWT"} {"sub":"demo","exp":1791785986}

The payload is readable by anyone. It's signed, not encrypted, so never put passwords or private data in it.

Use the token:

curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/me

{"username":"demo","full_name":"Demo User"}

curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/protected

{"message":"Hello demo, your JWT is valid.","framework":"FastAPI","language":"Python"}

9. Real test results: the failure cases

This is the part that tells you your auth actually works.

Test	Status	Response
`/me` with no token	401, `www-authenticate: Bearer`	`{"detail":"Not authenticated"}`
Login with a wrong password	401	`{"detail":"Incorrect username or password"}`
`/me` with the last character of the token changed	401	`{"detail":"Could not validate credentials"}`
`/me` with a token that expired 1 minute ago	401	`{"detail":"Could not validate credentials"}`

Changing a single character breaks the signature, and the expired token is rejected by PyJWT's built-in exp check. Neither needed any extra code.

The warning PyJWT 2.15 gave me

When I signed a token with the fallback secret, PyJWT printed:

InsecureKeyLengthWarning: The HMAC key is 25 bytes long, which is below the minimum recommended length of 32 bytes for SHA256. See RFC 7518 Section 3.2.

"dev-only-secret-change-me" is only 25 bytes. For HS256 your secret should be at least 32 bytes. secrets.token_urlsafe(32) gives you 43 characters, which is plenty. Set JWT_SECRET in .env and the warning disappears.

Before you ship this

This is a learning foundation, not a finished security system:

Move users into a real database, and hash passwords at signup, not at startup.
Keep the secret out of the repo. Use a secrets manager in production, and rotate it.
Add refresh tokens, so the 30-minute access token can stay short-lived.
Rate-limit /token to slow down password guessing.
Use HTTPS. A bearer token is as good as a password while it's valid.
Keep the failure tests from section 9 in your test suite.