HTTP Authentication

HTTP Basic, Bearer, and Digest authentication classes

HTTPBasic

HTTP Basic authentication.

Create an instance object and use that object as the dependency in Depends(). The dependency result will be an HTTPBasicCredentials object containing the username and the password.

Reference: RFC 7617

Parameters

scheme_name · str | None · default: "None"

Security scheme name. It will be included in the generated OpenAPI (e.g. visible at /docs).

realm · str | None · default: "None"

HTTP Basic authentication realm.

description · str | None · default: "None"

Security scheme description. It will be included in the generated OpenAPI (e.g. visible at /docs).

auto_error · bool · default: "True"

By default, if the HTTP Basic authentication is not provided (a header), HTTPBasic will automatically cancel the request and send the client an error.

If auto_error is set to False, when the HTTP Basic authentication is not available, instead of erroring out, the dependency result will be None.

This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in HTTP Basic authentication or in an HTTP Bearer token).

Example

from typing import Annotated
from fastapi import Depends, FastAPI
from fastapi.security import HTTPBasic, HTTPBasicCredentials

app = FastAPI()

security = HTTPBasic()

@app.get("/users/me")
def read_current_user(credentials: Annotated[HTTPBasicCredentials, Depends(security)]):
    return {"username": credentials.username, "password": credentials.password}

---

HTTPBasicCredentials

The HTTP Basic credentials given as the result of using HTTPBasic in a dependency.

Fields

username · str

The HTTP Basic username.

password · str

The HTTP Basic password.

---

HTTPBearer

HTTP Bearer token authentication.

Create an instance object and use that object as the dependency in Depends(). The dependency result will be an HTTPAuthorizationCredentials object containing the scheme and the credentials.

Parameters

bearerFormat · str | None · default: "None"

Bearer token format.

scheme_name · str | None · default: "None"

Security scheme name. It will be included in the generated OpenAPI (e.g. visible at /docs).

description · str | None · default: "None"

Security scheme description. It will be included in the generated OpenAPI (e.g. visible at /docs).

auto_error · bool · default: "True"

By default, if the HTTP Bearer token is not provided (in an Authorization header), HTTPBearer will automatically cancel the request and send the client an error.

If auto_error is set to False, when the HTTP Bearer token is not available, instead of erroring out, the dependency result will be None.

This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in an HTTP Bearer token or in a cookie).

Example

from typing import Annotated
from fastapi import Depends, FastAPI
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

app = FastAPI()

security = HTTPBearer()

@app.get("/users/me")
def read_current_user(
    credentials: Annotated[HTTPAuthorizationCredentials, Depends(security)]
):
    return {"scheme": credentials.scheme, "credentials": credentials.credentials}

---

HTTPDigest

HTTP Digest authentication.

Warning: this is only a stub to connect the components with OpenAPI in FastAPI, but it doesn’t implement the full Digest scheme, you would need to to subclass it and implement it in your code.

Reference: RFC 7616

Create an instance object and use that object as the dependency in Depends(). The dependency result will be an HTTPAuthorizationCredentials object containing the scheme and the credentials.

Parameters

scheme_name · str | None · default: "None"

Security scheme name. It will be included in the generated OpenAPI (e.g. visible at /docs).

description · str | None · default: "None"

Security scheme description. It will be included in the generated OpenAPI (e.g. visible at /docs).

auto_error · bool · default: "True"

By default, if the HTTP Digest is not provided, HTTPDigest will automatically cancel the request and send the client an error.

If auto_error is set to False, when the HTTP Digest is not available, instead of erroring out, the dependency result will be None.

This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in HTTP Digest or in a cookie).

Example

from typing import Annotated
from fastapi import Depends, FastAPI
from fastapi.security import HTTPAuthorizationCredentials, HTTPDigest

app = FastAPI()

security = HTTPDigest()

@app.get("/users/me")
def read_current_user(
    credentials: Annotated[HTTPAuthorizationCredentials, Depends(security)]
):
    return {"scheme": credentials.scheme, "credentials": credentials.credentials}

---

HTTPAuthorizationCredentials

The HTTP authorization credentials in the result of using HTTPBearer or HTTPDigest in a dependency.

The HTTP authorization header value is split by the first space. The first part is the scheme, the second part is the credentials.

For example, in an HTTP Bearer token scheme, the client will send a header like:

Authorization: Bearer deadbeef12346

In this case:

• scheme will have the value "Bearer"
• credentials will have the value "deadbeef12346"

Fields

scheme · str

The HTTP authorization scheme extracted from the header value.

credentials · str

The HTTP authorization credentials extracted from the header value.