Issue Access Tokens on Login
Sign a JWT and return it to the client.
Issue Access Tokens on Login is a free Flask Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Login Handshake
Login is a trade: the client sends valid credentials, and your server hands back a signed access token it can use on every later call.
Install the Extension
The Flask-JWT-Extended library does the signing and checking for you. One pip install and you are ready to mint tokens.
pip install flask-jwt-extendedSet the Signing Key
Tokens are signed with a secret. Configure JWT_SECRET_KEY so only your server can produce valid tokens. Keep it out of source code.
app.config["JWT_SECRET_KEY"] = "change-me"Create the JWTManager
Wrap your app in a JWTManager. This one object hooks Flask-JWT-Extended into request handling so the helpers work.
from flask_jwt_extended import JWTManager
jwt = JWTManager(app)A Route to Log In
Add a POST route at /login. It will read the submitted username and password from the request body.
@app.post("/login")
def login():
...Verify Credentials First
Never skip the check: confirm the password matches your stored hash before issuing anything. No valid login, no token.
Mint the Token
Call create_access_token with an identity, usually the user id. That id becomes the token's subject claim.
from flask_jwt_extended import create_access_token
token = create_access_token(identity=user.id)Return It as JSON
Send the token back in a JSON body. The client stores it and replays it on protected calls. 🔑
return {"access_token": token}, 200Identity Drives Claims
The identity you pass is what later requests will read back. Keep it small and stable, like a numeric user id.
Add Extra Claims
Need a role or plan in the token? Pass additional_claims so the data rides along and is available without a database hit.
create_access_token(identity=uid, additional_claims={"role": "admin"})Fail Logins Cleanly
If credentials are wrong, return 401 Unauthorized and no token. Clear, consistent failures keep your API predictable.
return {"msg": "Bad credentials"}, 401Quick Check
Recall which call actually produces the token.
Recap
Verify credentials, then create_access_token with the user id and return it as JSON. Set JWT_SECRET_KEY and a JWTManager first. ✅
Frequently asked questions
Is the “Issue Access Tokens on Login” lesson free?
Yes — the full text of “Issue Access Tokens on Login” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “Issue Access Tokens on Login”?
Sign a JWT and return it to the client. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Issue Access Tokens on Login” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Sessions vs Stateless Tokens
- Issue Access Tokens on Login
- Protect Endpoints with jwt_required
- Refresh Tokens and Expiry