AuthFast

A tiny authentication toolkit for FastAPI.

AuthFast gives FastAPI apps a simple way to add authentication without building the same routes, sessions, and database setup from scratch.

Install

pip install authfast

Default install supports SQLite. For production databases, install the matching driver extra:

pip install "authfast[postgres]"
pip install "authfast[mysql]"
pip install "authfast[all]"

Supported database targets:

• SQLite: sqlite:///./app.db or sqlite+aiosqlite:///./app.db
• PostgreSQL, Neon, Supabase Postgres: postgresql://... or postgresql+asyncpg://...
• MySQL/MariaDB: mysql://... or mysql+asyncmy://...

Create auth.py

Create .env next to auth.py:

AUTHFAST_SECRET_KEY=change-this-secret-for-local-development

from authfast import AuthFast

auth = AuthFast(
    database="sqlite:///./app.db",
    email_and_password={
        "enabled": True,
    },
)

Set Up The Database

authfast setup

The CLI looks for auth.py in ./, ./app, ./lib, ./src, ./src/app, and ./src/lib. For SQLite, the relative database path is resolved from the directory where you run the command or server. Run authfast setup and uvicorn from the same project root.

Use a custom path:

authfast setup --config examples/basic/auth.py

Drop and recreate AuthFast tables:

authfast setup --force

Mount Routes

from fastapi import FastAPI
from auth import auth

app = FastAPI()
app.include_router(auth.router)


@app.get("/protected")
async def protected(user=auth.user()):
    return {"id": user.id, "name": user.name, "email": user.email}

Use The API

Sign up:

curl -X POST http://127.0.0.1:8000/auth/sign-up/email \
  -H "Content-Type: application/json" \
  -d '{"name":"Dev","email":"dev@example.com","password":"secret123"}'

Log in:

curl -X POST http://127.0.0.1:8000/auth/sign-in/email \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","password":"secret123"}'

Use the session cookie or returned bearer token:

curl http://127.0.0.1:8000/auth/me \
  -H "Authorization: Bearer <access_token>"

Routes

• POST /auth/sign-up/email
• POST /auth/sign-in/email
• POST /auth/sign-out
• POST /auth/signup
• POST /auth/login
• POST /auth/logout
• GET /auth/me
• GET /auth/session

Example

From the project root:

authfast setup --config examples/basic/auth.py
uvicorn examples.basic.main:app --reload

Or from inside examples/basic:

authfast setup --config auth.py
uvicorn main:app --reload

Keep setup and uvicorn in the same working directory when using the example SQLite URL, because ./app.db is resolved from the current directory.

Reference

See docs/api-reference/index.mdx.