Auth Service
A production-style authentication service built with FastAPI and PostgreSQL that provides user registration, secure password hashing, JWT-based authentication, and protected API endpoints.
This service demonstrates how modern backend systems handle identity management and access control.
Features
User registration
Secure password hashing using bcrypt
JWT token generation for authentication
Token verification middleware
Protected API endpoints
PostgreSQL database integration
FastAPI REST API
Clean modular architecture
Tech Stack
Python
FastAPI
PostgreSQL
SQLAlchemy
JWT (python-jose)
Passlib (bcrypt)
Uvicorn
System Architecture
Client ↓ FastAPI Server ↓ Authentication Layer ↓ PostgreSQL Database
Authentication Flow:
User registers → password hashed → stored in database User logs in → JWT token generated Client sends token → protected routes verify token Access granted if token valid
Project Structure
auth_service/ │ ├── app/ │ ├── main.py │ ├── database.py │ ├── models.py │ ├── schemas.py │ ├── routes.py │ └── auth.py │ ├── requirements.txt ├── .env.example └── README.md
API Endpoints
Register User
POST /register
Example request:
{ "email": "[email protected]", "password": "password123" }
Login
POST /login
Response:
{ "access_token": "jwt_token_here", "token_type": "bearer" }
Protected Route
GET /profile
Requires Authorization header:
Authorization: Bearer <JWT_TOKEN>
Response:
{ "email": "[email protected]" }
Run Locally
Install dependencies
pip install -r requirements.txt
Start PostgreSQL
Ensure PostgreSQL is running and update database credentials in .env.
Run the server
python -m uvicorn app.main:app --reload --port 8003
Open API documentation:
Environment Variables
Example .env file:
DATABASE_URL=postgresql://user:password@localhost/auth_db SECRET_KEY=your_secret_key ALGORITHM=HS256 ACCESS_TOKEN_EXPIRE_MINUTES=30
Future Improvements
Refresh tokens
Email verification
OAuth login (Google/GitHub)
Password reset system
Role-based access control
Rate limiting for login attempts
About
This project is part of a backend systems portfolio demonstrating real-world backend patterns including authentication, security, and API development.