Auth for every FastAPI app you ship. Sign in, paid APIs, internal APIs and MCP.

Save this as main.py. The highlighted lines are MicroAuth: UserAuth(app) adds the sign in routes, and auth.login_required sends signed out visitors to sign in and back.

from fastapi import Depends, FastAPIfrom microauth_fastapi import User, UserAuth app = FastAPI()auth = UserAuth(app)  # reads the MICROAUTH_* settings @app.get("/dashboard")async def dashboard(user: User = Depends(auth.login_required)):    return {"hello": user.name, "roles": sorted(user.roles)}

Create a sign in service. MicroAuth makes a web app for it that already accepts localhost:8000, and shows a ready .env with a cookie secret made in your browser. Save it next to main.py.

MICROAUTH_ISSUER=https://yourapp.microauth.dev
MICROAUTH_CLIENT_ID=...
MICROAUTH_CLIENT_SECRET=...
MICROAUTH_COOKIE_SECRET=...
MICROAUTH_APP_URL=http://localhost:8000

fastapi dev main.py

Open localhost:8000/dashboard. It sends you to your sign in page, and once you sign up you land back on the dashboard with your name and roles.

Save this as main.py. Security(auth) checks the X-API-Key header, applies your limits and bills each successful call to the customer at your price.

from fastapi import FastAPI, Securityfrom microauth_fastapi import Customer, MicroAuth app = FastAPI()auth = MicroAuth(app)  # reads MICROAUTH_SECRET_KEY @app.get("/forecast")async def forecast(city: str, customer: Customer = Security(auth)):    return {"city": city, "forecast": "sunny", "customer": customer.id}

Create an API to sell and pick how to charge: pay as you go, monthly plans or a free quota. Your developer portal goes live straight away, and the dashboard shows your SDK secret key. Save it in .env next to main.py.

MICROAUTH_SECRET_KEY=mas_...

fastapi dev main.py

Sign up on your portal as a developer would, create a key and call your API with it. With pay as you go, the $1 welcome credit covers the first 1,000 calls.

curl "http://localhost:8000/forecast?city=Paris" -H "X-API-Key: map_..."

Save this as main.py. It's the same SDK as a paid API. With billing off, Security(auth) checks the key and its limits and tells you which team is calling.

from fastapi import FastAPI, Securityfrom microauth_fastapi import Customer, MicroAuth app = FastAPI()auth = MicroAuth(app)  # reads MICROAUTH_SECRET_KEY @app.get("/reports")async def reports(customer: Customer = Security(auth)):    return {"team": customer.id, "key": customer.key_id}

Protect an internal API. Sign up is invite only, billing is off and each team can make 10 requests a second until you change it. The dashboard shows your SDK secret key. Save it in .env next to main.py.

MICROAUTH_SECRET_KEY=mas_...

fastapi dev main.py

The Connect tab has a test key you can use straight away:

curl http://localhost:8000/reports -H "X-API-Key: map_..."

Then invite your teams under Customers. Once a team joins, it makes its own keys on your portal, or you issue one from its page with an expiry date.

Save this as main.py. It uses the official MCP Python SDK. Every call needs invoices:read, create_invoice also needs invoices:write, and api_keys=True accepts your users' keys next to sign in tokens.

from fastapi import FastAPIfrom mcp.server.mcpserver import MCPServerfrom microauth_fastapi import McpAuth, current_identity mcp = MCPServer("Invoices", log_level="WARNING")auth = McpAuth(scopes=["invoices:read"], api_keys=True)INVOICES: list[dict] = []  # your database @mcp.tool()@auth.tool("invoices:read")def list_invoices() -> list[dict]:    me = current_identity().sub    return [i for i in INVOICES if i["owner"] == me] @mcp.tool()@auth.tool("invoices:write")def create_invoice(customer: str, amount_cents: int) -> dict:    me = current_identity().sub    invoice = {"owner": me, "customer": customer, "cents": amount_cents}    INVOICES.append(invoice)    return invoice app = FastAPI()auth.mount(app, mcp)  # serves /mcp next to your other routes

Create an MCP sign in service named Invoices, with the server URL http://localhost:8000/mcp. MicroAuth registers the server with invoices:read and invoices:write. Then, in the dashboard:

• Under Roles and permissions, add a default role with both permissions, so everyone who signs up gets them.
• Under APIs and MCP servers, turn on API keys for your users, with a prefix such as inv.
• On the server's page, copy the .env it shows and create the server credentials for the last two lines.

MICROAUTH_ISSUER=https://yourapp.microauth.dev
MICROAUTH_RESOURCE=http://localhost:8000/mcp
MICROAUTH_RESOURCE_CLIENT_ID=rs_...
MICROAUTH_RESOURCE_SECRET=...

fastapi dev main.py

Sign up on your sign in page and create a key under API keys on your account page. Any MCP client that can send a header connects with it:

URL:     http://localhost:8000/mcp
Header:  Authorization: Bearer inv_...

On the Scale plan, Claude, ChatGPT and other AI clients can also sign people in through a consent screen once your server has a public https address, with no key to paste. The code stays the same. How AI clients connect