DevTrack — Authentication API
Production-style authentication service in Python/FastAPI on PostgreSQL, with JWT access tokens, rotating refresh tokens stored as hashes, session tracking, and httpOnly cookie delivery.
Overview
The authentication backbone for DevTrack, a developer-tracking app: a FastAPI service that handles registration, login, session management, and token refresh, built the way a production auth service should be rather than as a tutorial demo.
The Challenge
Long-lived tokens are the weak point of most JWT setups: a stolen refresh token stays valid until it expires. The service needed short-lived access tokens, refresh tokens that can be revoked and rotated on every use, and a database that never holds a usable token in plain text.
Approach
Modelled users, sessions, and refresh tokens in PostgreSQL with SQLAlchemy, versioning every schema change through Alembic migrations
Issued short-lived JWT access tokens and rotating refresh tokens; each refresh revokes the old token and issues a new pair
Stored only SHA-256 hashes of refresh tokens and hashed passwords with pwdlib, so a database leak exposes no usable credentials
Delivered tokens via httpOnly, SameSite-configurable cookies to keep them out of reach of client-side JavaScript
Validated every request and response with Pydantic schemas, a consistent success envelope, centralized exception handlers, request-ID middleware, and structured logging for traceable requests
Separated routers, services, and repositories so business logic is testable independently of HTTP and the database
A clean, layered FastAPI auth service with refresh-token rotation and revocation, fully documented through FastAPI's auto-generated Swagger/OpenAPI UI.