Quick Refresh on Authentication Basics with FastAPI, JWT, and Google OAuth
Welcome back, coding enthusiasts long time no see! Today we’re doing a quick refresh on the basics of authentication. We’ll walk through building a FastAPI backend with signup, login, email verification, JWT tokens, and Google OAuth login.
What is FastAPI & Why Not Just Python?
FastAPI is a modern Python web framework that makes building APIs super fast (pun intended 😎). You could technically write your authentication system in plain Python using Flask or even raw sockets, but FastAPI gives you:
- Automatic request validation with Pydantic models. No more manually checking every field.
- Automatic docs with Swagger UI so your API docs are basically built for free.
- Async support, which means faster response times if you need to handle lots of users at once.
In short, FastAPI helps you focus on the logic, not the plumbing. And trust me, authentication has enough plumbing already.
The Core Idea: How Authentication Works
Authentication is about proving who a user is. Here’s how our setup works:
- Sign Up – Users register with email + password. Password is hashed (never stored in plain text).
- Email Verification – Users must confirm their email via a unique link. This ensures they own the email.
- Login – Users can log in with email/password or via Google OAuth.
- JWT Tokens – After logging in, a JWT token is issued, proving the user is authenticated for protected routes.
Everything is tied together so that once a user signs up, they cannot sign up again with the same email. We check the database first.
Password Hashing: Because Plain Text is a No-No
We use bcrypt to hash passwords. Here’s the flow:
- When a user signs up, we hash their password with bcrypt.gensalt() and store the hash in the database.
- When they log in, we use bcrypt.checkpw() to verify the password against the hash.
- This way, even if the database leaks, passwords remain safe.
JWT Tokens: Your API Passport
JWT stands for JSON Web Token. Think of it like a passport for your API:
- When a user logs in, we generate a JWT with their email embedded as sub.
- The token has an expiry, usually 7 days in our case.
- Every time the user calls a protected route, we check the token , they’re only allowed in if this token is valid.
Fast, stateless, and secure. No sessions to manage on the server.
Email Verification: Making Sure It’s Really You
Email verification is a key step:
- When a user signs up, we generate a random token and store it in a verification_tokens table.
- We send them an email with a verification link pointing to /verify-email?token=XYZ.
- When they click it, our backend verifies the token and marks the user as verified.
- Bonus: we don’t delete the token immediatelalloy because it will allow safe re-use and auditing.
Sending the email is handled via smtplib in Python. You can customize the HTML and plain-text versions.
Google OAuth: Login With One Click
We also support Google login:
- The frontend sends a Google ID token to /api/auth/google.
- We decode it and check if the user exists in our database via google_id or email.
- If not, we create a new user and mark them verified automatically.
- Then, we issue a JWT just like regular login.
This allows users to bypass password setup entirely if they want.
How It All Comes Together
- app.py/main.py is the brain: it wires FastAPI routes, database connections, and services.
- auth.py contains all the logic: password hashing, JWT creation/verification, Google token verification, email token handling.
- email_service.py handles sending emails: verification emails and welcome emails.
- database.py manages connections and table setup.
- models.py defines request and response schemas for FastAPI to validate and serialize.
The architecture is clean: logic, models, services, and API are all separated, making it easy to maintain and scale.
And there you have it! That’s the full FastAPI authentication system we just dissected.
Next steps: implement your frontend to talk to these endpoints, test everything in Postman, and make sure your emails send correctly.
Happy coding, and may your JWTs never expire unexpectedly! ✨👩💻


















































