agentsclimarketplace
Sign in

Fastapi security

Skill dkmqflx/fastapi-best-practices-plugin/plugins/fastapi-best-practices/skills/fastapi-security

FastAPI security and authentication best practices. Use when implementing or reviewing auth in FastAPI — OAuth2PasswordBearer, get_current_user dependencies, router-level auth, password hashing, token endpoints. Triggers on OAuth2PasswordBearer, OAuth2PasswordRequestForm, get_current_user, or Depends-based auth.From its SKILL.md

Install
npx -y skills add dkmqflx/fastapi-best-practices-plugin --skill fastapi-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.1 KB, 404 tokens by cl100k_base, as published. Nobody here has run it

FastAPI Security & Authentication

Best practices for securing FastAPI applications, following the official security docs (https://fastapi.tiangolo.com/tutorial/security/). Covers extracting and validating Bearer tokens, resolving the current user as a dependency, protecting route groups, hashing passwords, and building the token-issuing endpoint. Each rule pairs an antipattern with the official FastAPI pattern.

When to Apply

Reference these guidelines when:

  • Extracting or validating a Bearer token from the Authorization header
  • Resolving the current authenticated user in a dependency
  • Protecting a group of routes at the APIRouter level
  • Hashing and verifying passwords
  • Building the /token (or equivalent) login endpoint

Rules

  • oauth2-bearer (CRITICAL) — extract Bearer tokens with OAuth2PasswordBearer + Annotated
  • get-current-user (CRITICAL) — resolve the current user in a get_current_user dependency
  • router-auth (HIGH) — protect route groups via APIRouter(dependencies=[...])
  • password-hashing (CRITICAL) — hash passwords (pwdlib/passlib); never store plaintext
  • token-endpoint (HIGH) — build the token route with OAuth2PasswordRequestForm

How to Use

Read the individual rule file for the detailed explanation and before/after example:

rules/oauth2-bearer.md
rules/get-current-user.md
rules/router-auth.md
rules/password-hashing.md
rules/token-endpoint.md

Each rule file contains:

  • A short explanation of why it matters, tied to the official docs
  • An Incorrect example (the antipattern)
  • A Correct example (the official pattern)
  • A link to the relevant page on https://fastapi.tiangolo.com/

All examples follow the official FastAPI documentation and avoid deprecated APIs.

What ships with it: 5 files

8.3 KB alongside SKILL.md

rules/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.