saastore-fastapi 0.1.0

FastAPI SDK adapter for saastore HMAC-signed identity headers

saastore-fastapi

FastAPI dependency that authenticates incoming requests via HMAC-signed identity headers issued by the saastore edge proxy.

Install

pip install saastore-fastapi

Use

from fastapi import Depends, FastAPI
from saastore_fastapi import SaastoreUser, saastore_user

app = FastAPI()

@app.get("/dashboard")
def dashboard(user: SaastoreUser = Depends(saastore_user)):
    return {"email": user.email, "plan": user.plan}

Environment

Variable	Required	Description
SAASTORE_HMAC_SECRET	Yes	Provided by saastore at container provision time. 64-character hex string.

What this rejects

• Missing identity headers — 401
• Bad signature — 401
• Timestamp more than 5 minutes off the container's clock — 401 (configurable freshness window in verify.py)
• SAASTORE_HMAC_SECRET env var unset — 500 (config error, not auth)

Wire format

See docs/superpowers/specs/2026-05-22-hosted-apps-poc-design.md section 5 in the saastore monorepo. The canonical signature string is user_id|email|plan|timestamp, signed with HMAC-SHA256 and hex-encoded.

Development

From the monorepo root:

cd sdks/saastore-fastapi
uv run --with fastapi --with httpx --with pytest pytest -v

License

MIT