FastAPI + PyJWT bearer auth: working versions (tested 2026-10-15)

fastapi==0.143.1
pyjwt==2.15.1
httpx==0.28.1
python-multipart==0.0.32
pytest==9.1.1

import os
from datetime import datetime, timedelta, timezone
import jwt
from fastapi import Depends, FastAPI, HTTPException, status
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm

SECRET = os.environ.get("JWT_SECRET", "dev-only-secret-change-me-32-bytes!!")
ALGO = "HS256"
oauth2 = OAuth2PasswordBearer(tokenUrl="token")
app = FastAPI()

def make_token(sub: str, minutes: int = 15) -> str:
    exp = datetime.now(timezone.utc) + timedelta(minutes=minutes)
    return jwt.encode({"sub": sub, "exp": exp}, SECRET, algorithm=ALGO)

def current_user(token: str = Depends(oauth2)) -> str:
    try:
        return jwt.decode(token, SECRET, algorithms=[ALGO])["sub"]
    except jwt.PyJWTError:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "invalid token", headers={"WWW-Authenticate": "Bearer"})

@app.post("/token")
def login(form: OAuth2PasswordRequestForm = Depends()):
    if form.password != "correct-horse":
        raise HTTPException(400, "bad credentials")
    return {"access_token": make_token(form.username), "token_type": "bearer"}

@app.get("/me")
def me(user: str = Depends(current_user)):
    return {"user": user}

from fastapi.testclient import TestClient
from app.main import app, make_token

client = TestClient(app)

def test_login_and_me():
    tok = client.post("/token", data={"username": "ada", "password": "correct-horse"}).json()["access_token"]
    assert client.get("/me", headers={"Authorization": f"Bearer {tok}"}).json() == {"user": "ada"}

def test_rejects_bad_and_expired():
    assert client.get("/me").status_code == 401
    expired = make_token("ada", minutes=-1)
    assert client.get("/me", headers={"Authorization": f"Bearer {expired}"}).status_code == 401

[pytest]
pythonpath = .