templates/blog-python-mongo
Template
1
Fork 0
Code Activity
blog-python-mongo/extras/auth-clerk/README.md
Leonardo Devai f17d20ff48 Review and modernize all 42 projects to the updated standard 
Pinned 2026 toolchains (Go 1.26, Rust 1.98/edition 2024, Python 3.14 + uv, Node 24,
Zig 0.16, NixOS 26.05), postgres 18 / mongo 8, lockfiles built from, non-root
runtimes, .dockerignore, per-project LICENSE, READMEs with the git.devai.io clone
line, checkout@v7 CI. Security fixes in the legacy Rust APIs (any-password login,
self-assigned admin, hard-coded JWT secret), JWT alg/exp/sub enforcement across the
blog series, safe markdown links in the frontends, and many smaller bugs — every
project was built, run and exercised end to end.

Adds scripts/publish.sh + a CI publish job that splits every folder into its own
repo at git.devai.io/templates/<folder>.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01128fhuZbgivaSJvtMf4s1G
2026-09-27 21:10:38 +02:00

1.4 KiB
Raw Permalink Blame History

Auth via Clerk

Replaces the built-in email/password auth with Clerk. Clerk owns sign-up, sign-in and sessions; the API only verifies the session JWT it receives against your instance's JWKS (RS256 signature, issuer, expiry, azp). One file, no Clerk SDK.

Install

  1. Add the RS256 backend: uv add "pyjwt[crypto]"
  2. Copy clerk_auth.py to app/clerk_auth.py
  3. In app/posts.py, change one import: from .clerk_auth import current_user_id
  4. Set CLERK_ISSUER to your Frontend API URL from the Clerk dashboard, e.g. https://your-app.clerk.accounts.dev, and CLERK_AUTHORIZED_PARTIES to the origins allowed to mint tokens for this API (comma-separated, checked against the azp claim; leave it unset to skip the check), e.g. https://your-site.com,http://localhost:5173

Delete / adjust

  • app/auth.py and its router registration in app/main.py — Clerk replaces /auth/register and /auth/login.
  • The users collection and its email index in app/db.py — Clerk stores your users.
  • posts.author_id now holds a Clerk user id (a string like user_2f…) instead of an ObjectId string. It was already stored as a string, so nothing to migrate — only the id format changes.
  • AUTH_SECRET is unused.

Clients get a token from Clerk's SDK (getToken()) and send it as Authorization: Bearer <token> — the write endpoints work unchanged.