Real logins for your class project. Zero headache.

Open a terminal and run these commands. They create a folder, move into it, and install FastAuth together with FastAPI.

uv init myapp
cd myapp
uv add fastauth_iq "fastapi[standard]"

Create a file called main.py in your folder and paste all of this in. You don't need to change anything yet.

from contextlib import asynccontextmanager

from fastapi import Depends, FastAPI
from sqlmodel import create_engine

from fastauth import FastAuth, User

# A database file that lives next to your code. No setup needed.
engine = create_engine("sqlite:///./app.db",
                       connect_args={"check_same_thread": False})

auth = FastAuth(
    secret_key="any-long-random-text-works-here",
    engine=engine,
)

# On startup: create the database and an admin user (admin / admin123)
@asynccontextmanager
async def lifespan(app: FastAPI):
    auth.initialize_db(admin_username="admin", admin_password="admin123")
    yield

app = FastAPI(lifespan=lifespan)

# This one line adds signup, login, logout, and more to your app
auth.setup(app)

# Your first protected page: only logged-in users can open it
@app.get("/protected")
def protected(user: User = Depends(auth.current_user)):
    return {"hello": user.username}

The secret_key is what signs your login tokens, so make it truly random. Generate one in your terminal and paste the output into secret_key="":

openssl rand -hex 32

# no openssl? (common on Windows) use Python instead
uv run python -c "import secrets; print(secrets.token_hex(32))"

uv run fastapi dev main.py

Created role: superadmin
Created new superadmin user: admin
INFO   Application startup complete.
INFO   Uvicorn running on http://127.0.0.1:8000

Your app is now running with a full auth system inside it. Leave the terminal open.

Open http://127.0.0.1:8000/docs in your browser. FastAPI draws an interactive page with every endpoint your app now has. Then:

1. Click the green Authorize button at the top right and log in with username admin and password admin123
2. Open GET /protected, click Try it out, then Execute

{
"hello": "admin"
}

Now click Authorize again and press Logout, then try GET /protected once more. You get a 401 Not authenticated error. That is your protection working.

You can also register a normal user with POST /users and log in as them. Try it: give yourself a username, an email, and a password.

Here is what FastAuth quietly did for you:

• Signup and login endpoints: /users, /token, /users/me, and /logout were added by auth.setup(app)
• Passwords are hashed with bcrypt, so real passwords are never stored in your database
• Logins use JWT tokens: after login, the client gets a signed token and sends it back with each request
• Roles are ready: an admin role already exists, and auth.admin protects admin-only routes the same way you protected /protected