로그인 시 액세스 토큰 발급하기

Login is a trade: the client sends valid credentials, and your server hands back a signed access token it can use on every later call.

The Flask-JWT-Extended library does the signing and checking for you. One pip install and you are ready to mint tokens.

Tokens are signed with a secret. Configure JWT_SECRET_KEY so only your server can produce valid tokens. Keep it out of source code.

Wrap your app in a JWTManager. This one object hooks Flask-JWT-Extended into request handling so the helpers work.

Add a POST route at /login. It will read the submitted username and password from the request body.

Never skip the check: confirm the password matches your stored hash before issuing anything. No valid login, no token.

Call create_access_token with an identity, usually the user id. That id becomes the token's subject claim.

Send the token back in a JSON body. The client stores it and replays it on protected calls. 🔑

The identity you pass is what later requests will read back. Keep it small and stable, like a numeric user id.

Need a role or plan in the token? Pass additional_claims so the data rides along and is available without a database hit.

If credentials are wrong, return 401 Unauthorized and no token. Clear, consistent failures keep your API predictable.

Recall which call actually produces the token.

Verify credentials, then create_access_token with the user id and return it as JSON. Set JWT_SECRET_KEY and a JWTManager first. ✅