Protect your FastAPI endpoints with Grantex grant tokens. Dependency-injection middleware that verifies JWTs, enforces scopes, and identifies agents.
Your FastAPI endpoints accept bearer tokens with no scope enforcement. Any valid token accesses any route. No way to identify which AI agent made the request.
Grantex verifies JWT signatures with the configured JWKS URI, enforces scopes per route, and provides typed agent identity context.
pip install grantex-fastapi — integrates with FastAPI dependency injection.
Use GrantexAuth as a dependency and auth.scopes() for required scopes.
The current Python verifier retrieves the configured JWKS during verification; account for that network dependency.
The dependency returns the full grant context: agent DID, scopes, principal, grant ID.
Configurable JWKS retrieval, scope enforcement, and typed authorization errors.
from fastapi import FastAPI, Depends
from grantex import VerifiedGrant
from grantex_fastapi import GrantexAuth
app = FastAPI()
auth = GrantexAuth(
jwks_uri="https://api.grantex.dev/.well-known/jwks.json"
)
@app.get("/api/emails")
async def list_emails(
grant: VerifiedGrant = Depends(auth.scopes("email:read"))
):
print(grant.agent_did)
print(grant.scopes)
return {"emails": []}Works with FastAPI's Depends() pattern. Pythonic and type-safe.
A callable dependency verifies tokens and returns a typed VerifiedGrant.
auth.scopes() creates a dependency that enforces required permissions and returns 403 on mismatch.
Full Pydantic model for grant context: agent DID, scopes, principal, grant ID.
Configure the signing-key endpoint used during token verification.
Typed authorization errors distinguish missing, invalid, expired, and insufficient-scope tokens.
This integration enforces authorization only where its wrapper or middleware is installed. Local JWT verification checks signatures and claims after JWKS retrieval; it does not prove current revocation unless the verifier performs an online state check or synchronizes revocation data.
Token verification does not create a consent record or prove that a tool executed. Use the configured authorization flow for grant decisions and add an audit integration at the execution boundary when action records are required.
Follow the integration guide and verify the package version before deployment. Apache 2.0.