JWT Bearer Auth
Stateless, self-contained tokens with short expiry. Verify cryptographically — no DB round-trip per request. Powered by HS256 or RS256.
Secure FastAPI in the Cloud
A compact FastAPI reference app with a working Books API, rich request logging, and balanced guidance for authentication and deployment on AWS, GCP, and Azure.
6
Books Endpoints
3
Cloud Providers
0
Secrets in Code
FastAPIAWSGCPAzure
from fastapi import FastAPI, Query
from pydantic import BaseModel
class BookListResponse(BaseModel):
items: list[BookResponse]
total: int
skip: int
limit: int
@app.get("/api/v1/books", response_model=BookListResponse)
async def list_books(skip: int = Query(0, ge=0), limit: int = Query(20, ge=1, le=100)):
return paginate_books(list(store.values()), skip=skip, limit=limit)What The Docs Cover
Concepts first, implementation second
Six core topics covered by the documentation. The live demo app implements the API-focused pieces and stays intentionally small.
Cloud IAM / Workload Identity
Zero secrets in code. IRSA on AWS, Workload Identity on GCP, Managed Identity on Azure. Your app gets short-lived tokens automatically from the platform.
Enterprise SSO
Cognito (AWS), Google Identity (GCP), or Microsoft Entra ID — enterprise login with MFA, conditional access, and app roles. JWKS-validated RS256 tokens.
RBAC Scopes
Fine-grained authorization with OAuth2 scopes. Use Security() — not just Depends() — to cleanly enforce access per endpoint.
Pydantic v2 Models
Separate request/response models so internal fields never leak. model_dump(exclude_unset=True) for clean partial updates.
Auto OpenAPI 3.1
Interactive Swagger UI and ReDoc generated from your type annotations — no YAML to maintain. Security schemes auto-wired.
The Big Picture
Three auth patterns, one decision
These patterns are not mutually exclusive — a production app typically uses all three simultaneously. Choose based on who or what is being authenticated.
01
User-facing AuthJWT Bearer
Use when: Generic internet users — mobile apps, SPAs, public APIs.
→User sends credentials
→Server issues signed JWT
→Client attaches Bearer token
→Server verifies cryptographically — no DB hit
02
Outbound Service AuthCloud IAM / Workload Identity
Use when: Your app talking to managed cloud services (databases, queues, secrets) — zero secrets in code on any cloud.
→App requests token from platform metadata service
→Cloud IAM issues short-lived credential
→App presents token to cloud service
→Service validates — no password ever stored
03
Enterprise SSOEnterprise IdP
Use when: Corporate users who authenticate via Cognito (AWS), Google Identity (GCP), or Entra ID (Azure) — with MFA and role-based access.
→User logs in via enterprise IdP (MFA, conditional access)
→IdP issues RS256 JWT with app roles / groups
→FastAPI fetches JWKS, validates token
→Roles claim drives authorization
Deploy Anywhere
Pick your cloud provider
All targets support platform-native IAM — no long-lived credentials stored anywhere in your deployment pipeline.
AWS
Lambda · EKS · Elastic Beanstalk
✓
Lambda
Serverless, pay-per-invocation with IRSA for secrets
✓
EKS
Kubernetes with IRSA for per-pod IAM
✓
Elastic Beanstalk
PaaS with one-command deploys
Google Cloud
Cloud Run · App Engine · GKE
✓
Cloud Run
Container-native serverless, scales to zero
✓
App Engine
Managed PaaS with automatic scaling
✓
GKE
Autopilot or standard Kubernetes with Workload Identity
Azure
Functions · App Service · AKS
✓
Azure Functions
Serverless with Managed Identity built-in
✓
App Service
PaaS with deployment slots and Key Vault refs
✓
AKS
Kubernetes with Workload Identity Federation
Quick Start
Up and running in 60 seconds
The live demo focuses on the Books API and observability basics. Hit /docs for the interactive Swagger UI. Auth and deployment patterns are explained in the docs alongside the running demo.
$
git clone https://github.com/jaredthivener/python-demo# clone the repo
$
cd python-demo
$
uv sync --group dev# install dependencies
$
uvicorn main:app --reload --no-access-log# start the server
INFO: Started server process
INFO: Waiting for application startup.
INFO: Application startup complete.
INFO: Uvicorn running on http://127.0.0.1:8000