現代のアプリユーザーは、新しいパスワードを作ることを望んでいません。その解決策が SSO（シングルサインオン） です。

この記事では、FastAPI, MongoDB, JWT, そして fastapi-sso ライブラリを使って、Google アカウントでログイン可能な SSO を構築する方法をステップ・バイ・ステップで解説します。

Continue reading "FastAPI で Google OAuth を使った Single Sign-On (SSO) を実装する方法" →

ในยุคที่ผู้ใช้งานไม่อยากจดจำรหัสผ่านอีกต่อไป — Single Sign-On (SSO) คือคำตอบ

บทความนี้จะแนะนำวิธีสร้างระบบล็อกอินผ่านบัญชี Google บนแอปพลิเคชัน FastAPI โดยใช้ MongoDB, JWT, และไลบรารี fastapi-sso เพื่อให้คุณเริ่มต้นได้อย่างมั่นใจและปลอดภัย

Continue reading "วิธีเชื่อมต่อระบบ Single Sign-On (SSO) ด้วย Google OAuth ใน FastAPI" →

Do your users really need another password to remember?

In modern web applications, Single Sign-On (SSO) is a must-have. It provides a seamless and secure authentication experience—allowing users to log in using trusted identity providers like Google, Microsoft, or Facebook.

In this guide, we’ll show you how to implement Google SSO using FastAPI, MongoDB, and JWT—in just a few steps.

---

🔎 Why Do We Need Single Sign-On (SSO)?

Managing passwords is painful—for users and developers. That’s where SSO comes in.

Here’s why modern apps need SSO:

🔐 1. Security

• Reduces the risk of password leaks and phishing
• Leverages trusted identity providers like Google, Microsoft, and Facebook
• Enables multi-factor authentication (MFA) automatically

🤝 2. User Convenience

• Users log in instantly using their existing accounts
• No need to remember or reset passwords
• Greatly reduces signup friction and improves retention

🛠️ 3. Simpler Development

• No need to build password reset flows or validate password strength
• Less user data to secure (e.g. no password storage)

🧩 4. Cross-Platform Access

• Users log in once to access multiple services
• Centralized authentication improves UX across your app ecosystem

💼 5. Enterprise-Ready

• Required for many internal tools and dashboards
• Works well with Google Workspace, Microsoft Azure AD, and more

---

✅ What We'll Use

Tool	Purpose
FastAPI	Python web framework
fastapi-sso	SSO integration with Google OAuth2
MongoDB + Motor	Store user records
python-jose	Generate and verify JWT tokens
passlib	Hash passwords (for fallback login)

---

⚙️ Step-by-Step: Implementing SSO with FastAPI

1. Install Required Packages

pip install fastapi uvicorn motor fastapi-sso python-dotenv python-jose passlib[bcrypt]

---

2. Set Up Google OAuth

1. Go to Google Cloud Console
2. Create a new project
3. Enable OAuth 2.0 Client ID
4. Set the redirect URI to:

http://localhost:8000/api/auth/google/callback

5. Copy the Client ID and Client Secret

---

3. Configure .env

Create a .env file in your project root:

MONGODB_URI=mongodb://localhost:27017
GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your-client-secret
GOOGLE_REDIRECT_URL=http://localhost:8000/api/auth/google/callback
JWT_SECRET=your_jwt_secret

---

4. Full FastAPI Code

See the full code here in our GitHub example, or build it using this structure:

# /api/auth/google/login → Redirects to Google
# /api/auth/google/callback → Handles user data, issues JWT
# /api/register → Optional manual registration
# /api/token → Password login
# JWT used for all access control

✅ Google login issues JWT for API access
✅ MongoDB stores new users only once
✅ FastAPI protects routes using the JWT token

---

🔄 SSO Login Flow Diagram

sequenceDiagram
    actor User
    participant Browser
    participant FastAPI
    participant GoogleOAuth
    participant MongoDB

    User->>Browser: Click "Login with Google"
    Browser->>FastAPI: GET /auth/google/login
    FastAPI->>GoogleOAuth: Redirect to Google OAuth URL
    User->>GoogleOAuth: Login & Consent
    GoogleOAuth->>FastAPI: Redirect to /auth/google/callback?code=XYZ
    FastAPI->>GoogleOAuth: Verify & fetch profile
    GoogleOAuth-->>FastAPI: Return user info (email, name, avatar)

    alt New User
        FastAPI->>MongoDB: Insert user profile
    else Existing User
        FastAPI->>MongoDB: Fetch user profile
    end

    FastAPI->>FastAPI: Generate JWT
    FastAPI-->>Browser: Return access_token or redirect with token
    Browser->>User: Authenticated!

---

🧾 Example MongoDB User Document

When a new user logs in via Google, we store:

{
  "_id": "ObjectId(...)",
  "username": "jane.doe@gmail.com",
  "email": "jane.doe@gmail.com",
  "full_name": "Jane Doe",
  "avatar_url": "https://lh3.googleusercontent.com/...",
  "sso_provider": "google",
  "created_at": "2025-07-02T08:00:00Z"
}

---

🔐 Using the JWT Token

After login, users receive a token like this:

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR...",
  "token_type": "bearer"
}

Use it in headers:

Authorization: Bearer <token>

Protect any route in FastAPI:

@router.get("/me")
async def me(current_user=Depends(get_current_user)):
    return current_user

---

🚀 What’s Next?

• Add Facebook or Microsoft SSO using the same pattern
• Redirect users to your frontend with token
• Add roles, permissions, or admin dashboard
• Handle mobile apps via deep linking

---

✅ Summary

You just learned how to:

• 🔧 Set up Google OAuth for FastAPI
• 🧠 Authenticate users using fastapi-sso
• 📦 Store user data in MongoDB
• 🔐 Issue JWT tokens for API access

This pattern scales well and forms the backbone of secure, modern user authentication.

---

🏢 Need Help?

Simplico Co., Ltd. helps startups and enterprises build fast, secure, and scalable backend systems using FastAPI, MongoDB, and cloud-native technologies.

Let’s bring your product to life—with speed and confidence.
🌐 Visit us at simplico.net