fastapi-sso is a FastAPI plugin designed to simplify integration of Single Sign-On (SSO) with common providers like Google, Facebook, Microsoft, and many others. It streamlines the OAuth2/OpenID Connect flow for authentication. The library is actively maintained with frequent minor and patch releases, currently at version 0.21.0.
pip install fastapi-ssoVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates setting up Google SSO. Ensure you register your application with Google Cloud Console to obtain a client ID and secret, and configure the authorized redirect URI to match `http://localhost:8000/auth/google/callback`. For production, ensure `allow_insecure_http` is `False` and `REDIRECT_URI` uses HTTPS. Environment variables are the recommended way to manage credentials.
Ensure your project uses Python 3.10 or higher. For version 0.21.0+, Python 3.10+ is required.
Upgrade to `fastapi-sso==0.19.0` or higher immediately. Note that future `1.0.0` versions plan to use a server-side state store.
Double-check that the `REDIRECT_URI` passed to the SSO provider object (e.g., `GoogleSSO`) precisely matches the URI registered with the third-party OAuth provider, including scheme (http/https), host, port, and path.
Toggle `allow_insecure_http` based on your environment. Use HTTPS for all production deployments.
Ensure the required scopes (e.g., 'openid', 'email', 'profile') are requested during SSO initialization. Check the raw `token` object received from the `authorize_access_token` call to understand its structure and adapt the code to correctly extract user information. For `Authlib` users (which `fastapi-sso` builds upon), consider using `userinfo` from the token if `parse_id_token` is problematic. For example: `user_info = token.get('userinfo')` or `user_info = await oauth.provider.userinfo(token=token)` if `id_token` itself is not directly in the top level of the token.Verify that the `redirect_uri` passed to `fastapi-sso` (both in initialization and `get_login_redirect` if provided) exactly matches the one registered with the OAuth provider. Ensure the `client_id` and `client_secret` are correct. Process the authorization code immediately after receiving it to avoid expiration. Also, verify that your server's clock is synchronized.
Add `SessionMiddleware` to your FastAPI application with a secure `secret_key`. Example: `app.add_middleware(SessionMiddleware, secret_key='your-super-secret-key-at-least-32-bytes')`. The secret key should be a long, random string.
Ensure that your `redirect_uri` in `fastapi-sso` initialization and the OAuth provider's settings explicitly match the *external* URL your users access. When behind a proxy, configure FastAPI to trust proxy headers (e.g., `app = FastAPI(root_path="/subpath")`). You might need to adjust Nginx configurations (e.g., `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme;`) and potentially use `allow_insecure_http=True` during local development if not using HTTPS.