How do you create a reusable current-user dependency in FastAPI?

WHAT THIS TESTS: This question tests whether you understand FastAPI's dependency injection system as a tool for composable, reusable logic rather than just a way to share database sessions. The interviewer wants to see that you know how to create sub-dependencies, that you understand the security integration with OpenAPI, and that you can keep endpoint functions focused on business logic instead of auth boilerplate.

A GOOD ANSWER COVERS: First, instantiate a security scheme like OAuth2PasswordBearer at module level so FastAPI knows where the token endpoint lives and can document it in the OpenAPI schema. Second, write a reusable async function such as get_current_user that itself accepts a token parameter injected via Depends on that scheme. Third, inside get_current_user, decode and validate the JWT or bearer token, handle expiration and credential exceptions by raising HTTPException with status 401, look up the user in the database if necessary, and return a Pydantic User model. Fourth, inject the user into any path operation by declaring a parameter with Annotated[User, Depends(get_current_user)], which makes the dependency explicit in the function signature and automatically adds the lock icon in the docs. Fifth, mention that because get_current_user is just another dependency, you can override it in tests with app.dependency_overrides to inject fake users without touching JWTs.

COMMON WRONG ANSWERS: A major red flag is suggesting middleware to extract the user and attach it to request.state. Middleware works but hides the dependency from the OpenAPI schema, breaks FastAPI's automatic interactive docs, and makes testing harder because the auth surface is no longer explicit. Another red flag is manually parsing request.headers.get("Authorization") inside every endpoint; this repeats code, misses the built-in security documentation, and ignores the standardized OAuth2 flow. A third red flag is returning the raw token string from the dependency instead of a validated user model, which forces every endpoint to do its own lookup.

LIKELY FOLLOW-UPS: The interviewer might ask how you would handle roles or scopes, which you can do by adding a scopes parameter to the OAuth2 scheme and checking them inside get_current_user or creating additional dependencies like require_admin that wrap get_current_user. They might also ask how to share the same dependency across routers, which is trivial because the function is just Python code imported wherever needed. Another follow-up is how you test endpoints that use this dependency; the correct pattern is using app.dependency_overrides before the TestClient call.

ONE CONCRETE EXAMPLE: You define oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token") once. Then you define async def get_current_user(token: Annotated[str, Depends(oauth2_scheme)]): decode JWT, validate, query DB, return User. In the route you write async def read_items(user: Annotated[User, Depends(get_current_user)]): return user. FastAPI resolves the chain automatically, the docs show the Authorize button, and you never repeat auth logic.