登录时颁发访问令牌
签署 JWT 并将其返回给客户端
登录时颁发访问令牌 是 CoddyKit 上的免费 Flask Academy 课时。 这是第 2 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Flask Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Flask Academy 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
The Login Handshake
Login is a trade: the client sends valid credentials, and your server hands back a signed access token it can use on every later call.
Install the Extension
The Flask-JWT-Extended library does the signing and checking for you. One pip install and you are ready to mint tokens.
pip install flask-jwt-extendedSet the Signing Key
Tokens are signed with a secret. Configure JWT_SECRET_KEY so only your server can produce valid tokens. Keep it out of source code.
app.config["JWT_SECRET_KEY"] = "change-me"Create the JWTManager
Wrap your app in a JWTManager. This one object hooks Flask-JWT-Extended into request handling so the helpers work.
from flask_jwt_extended import JWTManager
jwt = JWTManager(app)A Route to Log In
Add a POST route at /login. It will read the submitted username and password from the request body.
@app.post("/login")
def login():
...Verify Credentials First
Never skip the check: confirm the password matches your stored hash before issuing anything. No valid login, no token.
Mint the Token
Call create_access_token with an identity, usually the user id. That id becomes the token's subject claim.
from flask_jwt_extended import create_access_token
token = create_access_token(identity=user.id)Return It as JSON
Send the token back in a JSON body. The client stores it and replays it on protected calls. 🔑
return {"access_token": token}, 200Identity Drives Claims
The identity you pass is what later requests will read back. Keep it small and stable, like a numeric user id.
Add Extra Claims
Need a role or plan in the token? Pass additional_claims so the data rides along and is available without a database hit.
create_access_token(identity=uid, additional_claims={"role": "admin"})Fail Logins Cleanly
If credentials are wrong, return 401 Unauthorized and no token. Clear, consistent failures keep your API predictable.
return {"msg": "Bad credentials"}, 401Quick Check
Recall which call actually produces the token.
Recap
Verify credentials, then create_access_token with the user id and return it as JSON. Set JWT_SECRET_KEY and a JWTManager first. ✅
用 AI 导师学习 Python — 免费
在浏览器中编写并运行真实代码，获得全天候 AI 导师的即时帮助，并在网页或应用中继续学习。
- 课程
- 30
- 课程
- 120
常见问题解答
「登录时颁发访问令牌」课时是免费的吗？
是的 — 「登录时颁发访问令牌」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Flask Academy 课程的其余内容，请升级到 CoddyKit PRO。 Flask Academy 课程共包含 4 节课。
「登录时颁发访问令牌」这节课中我会学到什么？
签署 JWT 并将其返回给客户端 你通过在浏览器中直接运行的动手代码来练习 Flask Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Flask Academy 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Flask Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 2 节课，共 4 节。
「登录时颁发访问令牌」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Flask Academy 课中编写并运行代码吗？
能。每节 Flask Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。