A Blog full of AI Projects
Python FastAPI and Vue Authentication Boilerplate Recommendations and Use Cases
17-July-2026
Python FastAPI and Vue Authentication Boilerplate Recommendations and Use Cases
Over time, I have built several FastAPI + Vue authentication projects, each introducing a different authentication strategy. The right choice depends on the security requirements, application type, and desired user experience.
1. HTTP Basic Authentication
Recommended for:
Internal tools, small APIs, admin dashboards, and simple authenticated services.
This is the simplest authentication approach in the series. It is easy to understand and implement, making it suitable for smaller applications where users authenticate directly with a username and password.
Good use cases:
- Internal company tools
- Developer or admin dashboards
- Simple CRUD applications
- Learning FastAPI authentication dependencies
Not recommended for:
- Large public-facing applications
- Modern SPA applications requiring persistent sessions
- Systems requiring advanced token security
2. JWT Authentication (Access Tokens)
Recommended for:
APIs and applications requiring stateless authentication.
This boilerplate introduces JWT-based authentication where users receive an access token after login. The token is then used to access protected API endpoints.
Good use cases:
- REST APIs
- Mobile applications
- Single Page Applications (SPA)
- Microservice architectures
- Systems where server-side sessions are not desired
Advantages:
- Stateless authentication
- Easy API integration
- Scales well across multiple services
Limitations:
- Users need to log in again when tokens expire
- Token revocation is more difficult
3. JWT Refresh Token Renewal
Recommended for:
Single Page Applications and applications requiring longer user sessions.
This version introduces refresh tokens, allowing users to stay logged in after the short-lived access token expires.
Good use cases:
- Vue, React, and Angular applications
- User dashboards
- SaaS applications
- Applications where user experience is important
Advantages:
- Better user experience
- Short-lived access tokens improve security
- Users do not need frequent logins
Limitations:
- Refresh tokens must be protected carefully
- Basic refresh token handling does not detect token theft
4. JWT Refresh Token Rotation
Recommended for:
Production applications requiring stronger session security.
Refresh token rotation improves security by replacing the refresh token every time it is used. Each refresh operation creates a new token pair.
Good use cases:
- SaaS platforms
- Customer-facing applications
- Applications handling sensitive user data
- Long-lived user sessions
Advantages:
- Reduces the lifetime of stolen refresh tokens
- Makes token replay more difficult
- Follows modern authentication practices
Limitations:
- Requires more backend logic
- Token management becomes more complex
5. Refresh Token Reuse Detection (Without HTTP-only Cookies)
Recommended for:
Advanced authentication systems where refresh token attacks need to be detected.
This version adds detection of revoked refresh token reuse. If an old refresh token is used after rotation, the system can identify suspicious activity.
Good use cases:
- Security-focused applications
- Learning advanced authentication concepts
- Systems requiring visibility into suspicious sessions
Advantages:
- Detects refresh token replay attempts
- Improves security monitoring
- Adds protection against stolen refresh tokens
Limitations:
- Refresh tokens are still exposed to JavaScript if stored client-side
- Requires careful client-side handling
6. Refresh Token Reuse Detection with HTTP-only Cookies
Recommended for:
Production-grade web applications with high security requirements.
This is the most advanced version in the series. It combines refresh token rotation, reuse detection, and HTTP-only cookies to reduce exposure of sensitive tokens in the browser.
Good use cases:
- Production SaaS applications
- Banking and finance systems
- Enterprise applications
- Applications handling sensitive user information
Advantages:
- Refresh tokens are protected from JavaScript access
- Detects refresh token replay attempts
- Provides stronger protection against XSS-related token theft
- Better aligned with modern browser security practices
Considerations:
- Requires CSRF protection strategies
- More complex cookie and session management
Suggested Default Choice
- Learning project: HTTP Basic Authentication or JWT Authentication
- Small production API: JWT with Refresh Token Renewal
- Modern SaaS application: Refresh Token Rotation
- Security-focused production system: Refresh Token Rotation with Reuse Detection and HTTP-only Cookies
The final HTTP-only cookie version is the strongest foundation for most new web applications, while the earlier versions remain valuable as lightweight templates depending on project requirements...
Happy coding :-)
Python FastAPI with JWT Auth serving RAG by fake Embeddings (v1)
08-July-2026
Python FastAPI with JWT Auth serving a RAG Application using Groq + fake embeddings (v1) - hosted at Vercel Cloud using Serverless Functions
A Starter FastAPI + JWT Auth + Retrieval-Augmented Generation (RAG) by Groq LLM + fake embeddings + OpenAPI / Swagger - secured by HTTPS
A PostgreSQL database was used with the pgvector extension
During the development process, I used ChatGPT for assisting with code generation and Github Copilot for code inline suggestion
DevOps by VS Code + GitHub + Vercel Cloud
The Web API at GitHubPython FastAPI with JWT Auth serving a ReAct-inspired AI agent system
03-July-2026
Python FastAPI with JWT Auth serving a ReAct-inspired AI agent system - hosted at Vercel Cloud using Serverless Functions
The AI agent system follows a lightweight ReAct-inspired flow. A simple router determines when to use a Wikipedia tool, and the retrieved context is passed to the model to generate the final answer using a minimal of Langchain
A Starter FastAPI + JWT Auth + AI Agent system + OpenAPI / Swagger - secured by HTTPS
During the development process, I used ChatGPT for assisting with code generation and Github Copilot for code inline suggestion
DevOps by VS Code + GitHub + Vercel Cloud
The Web API at GitHubAI Agent Design Patterns
07-June-2026
ReAct (Reason + Act)
Concept: Alternate between reasoning steps and taking actions (tool calls, API calls, etc.)
Flow:
- LLM generates reasoning / thought
- Take action (call a tool or external system)
- Observe output and feed it back into reasoning
Strengths: Multi-step problem solving, tool orchestration, grounded responses
Use case: Complex question answering, multi-tool agents, decision-making systems
Tool-Calling / Tool-Augmented Agents
Concept: The LLM acts as a controller that decides whether to call external tools
Flow:
- LLM receives input
- LLM selects which tool(s) to call
- Execute tool(s)
- Synthesize final answer from tool output
Strengths: Reduces hallucinations, improves grounding, enables use of APIs and external systems
Use case: Wikipedia-style assistants, math solvers, structured data retrieval
Reflex / Reactive Agents
Concept: Immediate response without planning or multi-step reasoning
Flow: Input → Response
Strengths: Very fast, low complexity, low cost
Use case: Chatbots, simple Q&A systems
Plan-and-Execute / Hierarchical Planning Agents
Concept: The agent first creates a plan, then executes steps sequentially
Flow:
- LLM generates a plan
- Execute each step using tools or computations
- Return final result
Strengths: Strong for complex workflows and multi-step tasks
Use case: Automation systems, workflow orchestration, research agents
Debate / Self-Reflection Agents
Concept: Multiple candidate outputs are generated and evaluated before final selection
Flow:
- Generate multiple candidate answers
- Critique or evaluate each candidate
- Select the best final output
Strengths: Reduces errors, improves reliability, reduces hallucinations
Use case: Code review, summarization, high-accuracy Q&A
Memory-Augmented Agents
Concept: The agent stores and retrieves long-term memory to maintain context
Flow:
- Retrieve relevant past memory
- Reason using current input + memory
- Update memory with new information
Strengths: Personalization, continuity, long-term context awareness
Use case: Personal assistants, long-running agents, adaptive systems
- ReAct: reasoning + acting with tools in loops
- Tool-Calling: LLM chooses external tools
- Reflex: direct single-step response
- Plan-and-Execute: plan first, then execute steps
- Debate: multiple outputs + self-evaluation
- Memory-Augmented: persistent context over time
Python FastAPI with JWT Auth serving ML Inference API solving the XOR Problem by PyTorch
01-June-2026
Python FastAPI with JWT Auth serving a PyTorch-trained MLP model exported to ONNX with strict XOR input validation - hosted at Vercel Cloud using Serverless Functions
A Starter FastAPI + JWT Auth + Deep Learning to solve the XOR Problem + OpenAPI / Swagger - secured by HTTPS
During the development process, I used ChatGPT for assisting with code generation and Github Copilot for code inline suggestion
DevOps by VS Code + GitHub + Vercel Cloud
The Web API at GitHub