Verification, Password Reset, OAuth2 & Design Tradeoffs

Email Verification & Password Reset

Email verification sends a token/link to the registered address that the user must confirm before the account is fully verified — proving they actually control that address. Password reset works similarly: FastAPI Users generates and validates the reset token and hook points, but expects the application to actually deliver that token via its own email provider integration — sending email itself is outside the library's scope.

The User Manager Extension Point

A pluggable user manager class is the main customization point — subclassed to add lifecycle hooks (a welcome email on registration, custom validation) beyond the library's defaults, without reimplementing the whole registration/verification flow.

OAuth2 / Social Login

Optional OAuth2 integration lets users authenticate via a third-party provider ("Sign in with Google"), linking that external identity to a FastAPI Users account rather than requiring a separate password for that user — alongside, not necessarily replacing, standard email/password auth.

Request/Response Schema Separation

As with any Pydantic-based FastAPI app, the underlying user model may hold sensitive fields (hashed password, internal flags) that shouldn't be serialized directly into a response — a restricted UserRead output schema is used instead of exposing the raw internal model. User IDs commonly default to UUIDs rather than auto-incrementing integers, avoiding leaking signup volume/order and sidestepping collisions when merging data across systems.

Why Not Roll Your Own?

Authentication involves subtle security details (password hashing, token handling, session fixation) that are easy to get wrong; a widely used library benefits from broader scrutiny than a one-off implementation. That said, a trivial internal tool with one fixed set of credentials may reasonably skip the full library in favor of something simpler like basic auth or a hardcoded API key.