FastAPI

Just want one protected route? Start with the FastAPI quickstart.

authdog.fastapi exposes session context and a 401 gate as FastAPI dependencies. Other Python frameworks have their own guides: Django, Flask, Starlette, aiohttp. Hub: Python.

Availability and install

Unreleased on PyPI. Source-only in `packages/python`. Python 3.10+, FastAPI 0.110+, httpx 0.27+.

python -m pip install "./packages/python[fastapi]"

Pin a commit. Published compatibility is not yet guaranteed.

Configure

import os
from authdog.fastapi import Authdog

authdog = Authdog(public_key=os.environ["PK_AUTHDOG"])

The key is publishable. Construction rejects malformed keys and identity hosts outside the trusted HTTPS allowlist.

Session and gate

session is optional context. require_auth is the 401 dependency. Context is cached on request.state, so composing both costs one userinfo call.

from fastapi import Depends, FastAPI, Request

app = FastAPI()

@app.get("/")
async def index(ctx=Depends(authdog.session)):
    return {"authenticated": ctx.is_authenticated}

@app.get("/me")
async def me(user=Depends(authdog.require_auth)):
    return user

@app.get("/logout")
async def logout(request: Request):
    return authdog.logout(request)

logout(request) expires the cookie and redirects to a sanitized redirect_uri.

Shared rules

The resolver prefers authdog-session, then Authorization: Bearer <token>. Failed userinfo is anonymous. fetch_user=False leaves is_authenticated false, so require_auth rejects. Authentication is not authorization — apply authorization after the gate.

Self-hosted identity hosts need AUTHDOG_ALLOWED_IDENTITY_HOSTS.