The Whole Thing: Agent → FastAPI → JWT

What you'll learn

• Serve an agent as an async REST API with FastAPI
• Mint, verify and expire JWTs; hash passwords properly
• Guard endpoints with OAuth2 bearer dependencies
• Walk the full login → token → protected /chat pipeline

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 . eyJzdWIiOiJhbGljZSIsImV4cCI6MTc5OTk5OTk5OX0 . 3vJk4XbF0qPzR8wYtN2mHc5dLuKaGeSAoQx17EnUyfM

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "alice",
  "exp": 1799999999
}

We just read the header and payload with no key at all — exactly like the notebook's peek(). The lesson: a JWT is signed, not encrypted. Never put secrets in the payload; the signature only proves who minted it and that nobody changed it.

oauth2 = OAuth2PasswordBearer(tokenUrl="login")   # "tokens arrive in the Authorization header"

def get_current_user(token: str = Depends(oauth2)) -> str:
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])   # signature + expiry
    except jwt.PyJWTError:                                                # any failure -> 401
        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Could not validate credentials")
    return payload["sub"]


@app.post("/chat")
async def chat(req: ChatIn, user: str = Depends(get_current_user)):    # <-- PROTECTED
    #                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^ the ENTIRE auth layer.
    #  FastAPI runs the guard first. If it raises 401, this function never executes.
    result = await agent.run(req.message)
    return {"user": user, "reply": result.output}

One Depends(get_current_user) in the signature and the endpoint is secured — jwt.decode checks the signature and the expiry in a single call. Passwords, meanwhile, are never stored: only SHA-256 hashes live in the DB, and login compares fingerprints.