Node.js Backend Development Bootcamp · Lesson

OAuth2 Password Flow Integration

Integrate the OAuth2 password flow for user login and token acquisition within your FastAPI application.

OAuth2 Password Flow Integration is a free Node.js Backend Development Bootcamp lesson on CoddyKit — lesson 4 of 6. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Node.js Backend Development Bootcamp learning path, one of 6 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Intro to OAuth2 Password Flow

Welcome! This lesson focuses on integrating the OAuth2 Password Flow in FastAPI. It's a standard and secure way for users to log in to your application.

This flow allows users to provide their username and password directly to your API. If successful, your API issues an access token, which the user then uses to access protected resources.

Why Use Password Flow?

The OAuth2 Password Flow is particularly suitable for first-party applications, like your own mobile app or web frontend, where you fully trust the client.

Security: It's a widely adopted, well-understood security standard.
Simplicity: Provides a straightforward login experience for users.
Token-based: After login, users get a token, avoiding the need to send credentials with every request.

Key FastAPI Components

FastAPI provides specialized utilities to make implementing OAuth2 Password Flow easy:

OAuth2PasswordBearer: A dependency that extracts the access token from the Authorization: Bearer header of incoming requests.
OAuth2PasswordRequestForm: A dependency that automatically parses the username and password from the form data sent during a login request.

We'll combine these with FastAPI's powerful Dependency Injection system.

Setting up OAuth2PasswordBearer

First, we need to initialize OAuth2PasswordBearer. The tokenUrl parameter is crucial; it tells clients where to send their login credentials to obtain an access token.

This URL will be the path to our login endpoint.

from fastapi import FastAPI
from fastapi.security import OAuth2PasswordBearer

app = FastAPI()

# 'token' is the URL path where clients will log in
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

# We will create a @app.post("/token") endpoint next!

The Login Endpoint: /token

This is the core endpoint where users will send their username and password. It's typically a POST request.

We use OAuth2PasswordRequestForm as a dependency. FastAPI automatically parses the incoming form data and provides username and password attributes.

from fastapi import Depends, HTTPException, status
from fastapi.security import OAuth2PasswordRequestForm

@app.post("/token")
async def login_for_access_token(
    form_data: OAuth2PasswordRequestForm = Depends()
):
    # 1. Authenticate user (verify username/password)
    # 2. If valid, create an access token
    # 3. Return the token
    pass # Details coming in the next scene!

Full Code: Login & Protected Endpoint

Here's a complete FastAPI application demonstrating the OAuth2 Password Flow. It includes the /token endpoint for login and a /users/me/ endpoint protected by the access token.

Run this code: Save as main.py, then uvicorn main:app --reload. Access docs at http://127.0.0.1:8000/docs.

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
from pydantic import BaseModel
from typing import Optional

app = FastAPI()

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

# --- Mock User & Token Logic (Simplified for this lesson) ---
class UserInDB(BaseModel):
    username: str
    hashed_password: str
    disabled: Optional[bool] = None

class CurrentUser(BaseModel):
    username: str
    email: Optional[str] = None
    full_name: Optional[str] = None
    disabled: Optional[bool] = None

fake_users_db = {
    "testuser": UserInDB(username="testuser", hashed_password="password123", disabled=False),
    "disableduser": UserInDB(username="disableduser", hashed_password="securepass", disabled=True)
}

def get_user_from_db(username: str):
    user_data = fake_users_db.get(username)
    if user_data:
        return CurrentUser(username=user_data.username, full_name=f"{user_data.username} Full", email=f"{user_data.username}@example.com", disabled=user_data.disabled)
    return None

def authenticate_user(username: str, password: str):
    user_in_db = fake_users_db.get(username)
    if not user_in_db or user_in_db.hashed_password != password: # In real app, use password hashing
        return None
    return get_user_from_db(username)

def create_access_token(data: dict):
    # In a real app, use `jwt.encode` with a secret key (from Lesson 1)
    return f"mock_jwt_for_{data['sub']}"
# --- End Mock Logic ---

@app.post("/token")
async def login_for_access_token(
    form_data: OAuth2PasswordRequestForm = Depends()
):
    user = authenticate_user(form_data.username, form_data.password)
    if not user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect username or password",
            headers={"WWW-Authenticate": "Bearer"},
        )
    if user.disabled:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Inactive user"
        )
    access_token = create_access_token(data={"sub": user.username})
    return {"access_token": access_token, "token_type": "bearer"}

# Dependency to get the current user from the token
async def get_current_user(token: str = Depends(oauth2_scheme)):
    # In a real app, this would decode and validate the JWT (from Lesson 1)
    if not token.startswith("mock_jwt_for_"):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid authentication credentials",
            headers={"WWW-Authenticate": "Bearer"},
        )
    username = token.replace("mock_jwt_for_", "")
    user = get_user_from_db(username)
    if user is None or user.disabled:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid authentication credentials or inactive user",
            headers={"WWW-Authenticate": "Bearer"},
        )
    return user

# A Protected Endpoint
@app.get("/users/me/", response_model=CurrentUser)
async def read_users_me(current_user: CurrentUser = Depends(get_current_user)):
    return current_user

Understanding get_current_user

The get_current_user function is a crucial dependency. It performs two main tasks:

Extract Token: Uses oauth2_scheme = Depends(OAuth2PasswordBearer(...)) to get the token from the Authorization header.
Validate & Fetch User: Decodes and validates the token (using JWT logic from Lesson 1 in a real app). If valid, it fetches and returns the corresponding User object. If invalid or missing, it raises an HTTPException.

How Clients Interact

Here's a typical client interaction with the OAuth2 Password Flow:

Client (e.g., mobile app) sends a POST request to /token with username and password in form data.
If successful, the API returns an access_token (e.g., {"access_token": "abc.123.xyz", "token_type": "bearer"}).
For subsequent protected requests, the client includes this token in the Authorization header: Authorization: Bearer abc.123.xyz.

Quick Check: OAuth2 Components

Which FastAPI component is primarily responsible for parsing the username and password from an incoming login request (form data)?

Recap: OAuth2 Password Flow

You've successfully integrated the OAuth2 Password Flow in FastAPI!

You initialized OAuth2PasswordBearer with a tokenUrl.
You created a /token endpoint using OAuth2PasswordRequestForm to handle user login.
You understood how to authenticate users and issue access tokens.
You secured endpoints by using a get_current_user dependency to extract and validate the access token.

Next, you can explore Role-Based Access Control (RBAC) to add more granular permissions based on user roles!

Frequently asked questions

Is the “OAuth2 Password Flow Integration” lesson free?

Yes — the full text of “OAuth2 Password Flow Integration” is free to read here on the web, and the Node.js Backend Development Bootcamp course includes 6 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Node.js Backend Development Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “OAuth2 Password Flow Integration”?

Integrate the OAuth2 password flow for user login and token acquisition within your FastAPI application. You practise Node.js Backend Development Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Node.js Backend Development Bootcamp?

No prior experience is required. Node.js Backend Development Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 6, so you can start here or from the beginning and move at your own pace.

How long does the “OAuth2 Password Flow Integration” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Node.js Backend Development Bootcamp lesson?

Yes. Every Node.js Backend Development Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Node.js Backend Development Bootcamp