Welcome to Authentication and Security, the sixth module of the course. Right now anyone can read, change, or delete every task in your API — there’s no notion of who is making a request. Real applications need authentication (knowing who you are) and authorization (knowing what you’re allowed to do). This module adds both, using the patterns that have become the industry standard for APIs.

You’ll start with the OAuth2 password flow — the login-with-username-and-password pattern FastAPI supports out of the box — and the /token endpoint that powers it. You’ll hash passwords so they’re never stored in plain text, issue and verify JWT access tokens (signed, tamper-proof, and self-expiring), and write a current-user dependency that turns a token back into a user. Finally you’ll protect routes so only logged-in users can reach them, and add role checks so only admins can do admin things. The module ends with a guided project: an auth-protected API where users register, log in, and access endpoints gated behind a valid token.

Every example is real, runnable code verified end to end. Start with Lesson 1, where you’ll take your first security steps with the OAuth2 password flow.