FastAPI JWT Middleware Skill

Purpose

This skill provides implementation details for secure JWT verification middleware in FastAPI, specifically integrated with Better Auth secrets.

Capabilities

• Secure JWT extraction from Bearer headers
• Signature verification using

  BETTER_AUTH_SECRET

• Decoding and extraction of

  user_id

  and

  email

• Route-level ownership validation (matching

  user_id

  to route paths)
• Dependency injection patterns for FastAPI routes
• Standardized error handling (401/403 HTTPExceptions)

Implementation Details

JWT Extraction & Verification

Extract the token from the

Authorization

header and verify it against the

BETTER_AUTH_SECRET

environment variable.

Data Model

Ensure the decoded payload contains:

• user_id

  : The unique identifier for the user.

• email

  : The user's email address.

Permissions

Implement a check to ensure that if a

user_id

is present in the route path, it matches the

user_id

in the JWT payload.

Error Handling

• Raise

  401 Unauthorized

  if the token is missing, invalid, or expired.
• Raise

  403 Forbidden

  if the

  user_id

  validation fails.

Usage

Include the middleware as a dependency in FastAPI routes:

@app.get("/users/{user_id}/profile")
async def get_profile(user_id: str, user: User = Depends(get_current_user)):
    # get_current_user logic handles JWT and user_id matching
    ...