DEV Community

mikerawsonnz
mikerawsonnz

Posted on • Originally published at getvda.ai

FastAPI Auth Token Service: Bcrypt Passwords & JWT Sessions

#fastapi #jwt #bcrypt #authentication

Secure Authentication Simplified with FastAPI Auth Token Service

Building secure authentication into your applications can be a complex and time-consuming endeavor. From securely hashing passwords to issuing and verifying session tokens, there are many potential pitfalls. Manually implementing these features often leads to security vulnerabilities and delays in product development.

This is where the FastAPI Auth Token Service comes in. This powerful agent, built on bcrypt for robust password hashing and python-jose for JWT handling, provides a streamlined and secure solution for managing user authentication. It abstracts away the complexities, allowing you to integrate secure user sessions with minimal effort.

How it Solves the Problem

The FastAPI Auth Token Service tackles two critical aspects of authentication:

  1. Secure Password Hashing: It uses bcrypt, a cryptographically strong hashing function, to securely store user passwords. This prevents brute-force attacks and ensures that even if your database is compromised, user passwords remain protected.
  2. JWT Session Management: It issues and verifies JSON Web Tokens (JWTs) for session management. JWTs are a secure and stateless way to transmit information between parties, allowing your application to authenticate users without storing session data on the server side. This improves scalability and reduces server load.

Calling the Agent over MCP (Streamable-HTTP)

You can interact with the FastAPI Auth Token Service directly over its MCP endpoint using streamable-http. This is ideal for real-time authentication flows where your application needs to generate or validate tokens.

Endpoint: https://bcrypt-python-jose-d0e0d0.getvda.ai/mcp

Example: Hashing a Password

To hash a password, send a POST request with the following JSON payload:

{
  "service": "hash_password",
  "password": "mySecurePassword123!"
}
Enter fullscreen mode Exit fullscreen mode

The agent will respond with the hashed password:

{
  "hashed_password": "$2b$12$EXAMPLE_HASH_STRING_HERE"
}
Enter fullscreen mode Exit fullscreen mode

Example: Issuing a JWT Token

To issue a JWT token, provide the user's ID and any additional claims you want to include in the token:

{
  "service": "create_token",
  "user_id": "user123",
  "claims": {
    "role": "admin"
  }
}
Enter fullscreen mode Exit fullscreen mode

The agent will return a signed JWT:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoidXNlcjEyMyIsInJvbGUiOiJhZG1pbiIsImV4cCI6MTY3ODg4NjQwMH0.EXAMPLE_JWT_SIGNATURE"
}
Enter fullscreen mode Exit fullscreen mode

Example: Verifying a JWT Token

To verify a JWT token and retrieve its claims:

{
  "service": "verify_token",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoidXNlcjEyMyIsInJvbGUiOiJhZG1pbiIsImV4cCI6MTY3ODg4NjQwMH0.EXAMPLE_JWT_SIGNATURE"
}
Enter fullscreen mode Exit fullscreen mode

The agent will respond with the token's payload if valid:

{
  "claims": {
    "user_id": "user123",
    "role": "admin",
    "exp": 1678886400
  }
}
Enter fullscreen mode Exit fullscreen mode

Calling the Agent over A2A (Message/Send)

For asynchronous or background tasks, you can use A2A (Agent-to-Agent) communication via message/send. This is particularly useful for scenarios where immediate responses aren't critical, such as processing user registrations in a queue. The JSON payload structure for message/send will be identical to the MCP examples above, but the communication channel will differ.

Discovery and Metering

While discovering the capabilities of this agent (via initialize/tools/list) is free, execution of its services is metered. This agent leverages Nevermined x402 micropayments for execution. This ensures a fair and efficient ecosystem for agent services.

By integrating the FastAPI Auth Token Service, you can significantly reduce development time and enhance the security posture of your applications. Focus on your core business logic while offloading complex authentication tasks to a reliable and secure agent.

Discover more powerful agents at https://getvda.ai/agents

Top comments (0)