Implement OAuth2 Password Flow in FastAPI

What's really being asked

This question evaluates whether you can assemble FastAPI's security primitives into a production-ready password flow. The interviewer cares about your understanding of stateless authentication, password hashing, dependency injection, and the exact contract between the token endpoint and the Bearer dependency. It also surfaces whether you treat security as a first-class design concern or an afterthought.

The full answer

First, the POST /token path operation receives an OAuth2PasswordRequestForm, which parses the username and password from application/x-www-form-urlencoded data. Second, the endpoint verifies the submitted password against a stored hash using a library like pwdlib, and only on success does it create a JWT with a subject claim containing the username. Third, the endpoint returns a JSON payload with access_token and token_type set to bearer. Fourth, protected routes depend on OAuth2PasswordBearer with a tokenUrl pointing at the token endpoint, which extracts the Authorization header containing the Bearer token. Fifth, a reusable get_current_user dependency decodes the JWT using the secret key and algorithm, validates the sub claim, and returns the user object to the path operation.

The mistakes people make

Storing or comparing passwords in plain text is an immediate rejection. Another red flag is omitting the OAuth2PasswordBearer dependency and instead manually parsing headers. Some candidates describe a session cookie flow rather than the stateless JWT pattern the question asks for. Confusing the resource owner password credentials flow with authorization code flow or client credentials flow also signals weak OAuth2 knowledge.

What usually comes next

The interviewer may ask how you would refresh tokens without re-prompting for the password, how to revoke tokens when the JWT is stateless, or how to add OAuth2 scopes to restrict endpoint access. They might also probe how you would rotate the signing key or store secrets outside the codebase.

A concrete example

Imagine a login endpoint at POST /token. The client sends username=alice and password=secret. FastAPI injects OAuth2PasswordRequestForm. The endpoint hashes the incoming password with pwdlib and compares it to the stored hash for alice. On match, it builds a JWT with sub set to alice and exp set to fifteen minutes. The client receives an access_token and token_type bearer. On a subsequent GET /users/me request, the client sends an Authorization header containing the Bearer token. The OAuth2PasswordBearer dependency extracts the string, get_current_user decodes it, validates the sub against the user database, and injects the user record into the handler.