title: How to use HTTP Basic Auth as separate FastAPI service?
body: <p><strong>What I want to achieve?</strong> Have one service responsible for HTTP Basic Auth (access) and two services (a, b) where some endpoints are protected by access service.</p>
  <p><strong>Why?</strong> In scenario where there will be much more services with protected endpoints to not duplicate <a href="https://github.com/ethru/http_basic_example/blob/master/example-service/app/main.py#L12-L21" rel="nofollow noreferrer">authorize function</a> in each service. Also to do modification in one place in case of changing to OAuth2 (maybe in future).</p>
  <p><strong>What I did?</strong>
  I followed guide on <a href="https://fastapi.tiangolo.com/advanced/security/http-basic-auth/" rel="nofollow noreferrer">official website</a> and created <a href="https://github.com/ethru/http_basic_example/blob/master/example-service/app/main.py" rel="nofollow noreferrer">example service</a> which works totally fine.</p>
  <p><strong>Problem</strong> occurs when I try to move authorization to separate <a href="https://github.com/ethru/http_basic_example/blob/master/access-service/app/main.py" rel="nofollow noreferrer">service</a> and then use it within few other
  services with protected endpoints. I can't figure out how to do it. Could you please help me out?</p>
  <p>I have tried different functions setup. Nothing helped, so far my code looks like this:</p>
  <p><strong>access-service</strong></p>
  <pre><code>import os
  import secrets
  
  from fastapi import FastAPI, Depends, HTTPException, status
  from fastapi.security import HTTPBasic, HTTPBasicCredentials
  
  security = HTTPBasic()
  
  
  def authorize(credentials: HTTPBasicCredentials = Depends(security)):
      is_user_ok = secrets.compare_digest(credentials.username, os.getenv('LOGIN'))
      is_pass_ok = secrets.compare_digest(credentials.password, os.getenv('PASSWORD'))
  
      if not (is_user_ok and is_pass_ok):
          raise HTTPException(
              status_code=status.HTTP_401_UNAUTHORIZED,
              detail='Incorrect email or password.',
              headers={'WWW-Authenticate': 'Basic'},
          )
  
  
  app = FastAPI(openapi_url=&quot;/api/access/openapi.json&quot;, docs_url=&quot;/api/access/docs&quot;)
  
  
  @app.get('/api/access/auth', dependencies=[Depends(authorize)])
  def auth():
      return {&quot;Granted&quot;: True}
  </code></pre>
  <p><strong>a-service</strong></p>
  <pre><code>import httpx
  import os
  
  from fastapi import Depends, FastAPI, HTTPException, status
  
  ACCESS_SERVICE_URL = os.getenv('ACCESS_SERVICE_URL')
  
  app = FastAPI(openapi_url=&quot;/api/a/openapi.json&quot;, docs_url=&quot;/api/a/docs&quot;)
  
  
  def has_access():
      result = httpx.get(os.getenv('ACCESS_SERVICE_URL'))
      if result.status_code == 401:
          raise HTTPException(
              status_code=status.HTTP_401_UNAUTHORIZED,
              detail='No access to resource. Login first.',
          )
  
  
  @app.get('/api/a/unprotected_a')
  async def unprotected_a():
      return {&quot;Protected&quot;: False}
  
  
  @app.get('/api/a/protected_a', dependencies=[Depends(has_access)])
  async def protected_a():
      return {&quot;Protected&quot;: True}
  
  
  @app.get('/api/a/protected_b', dependencies=[Depends(has_access)])
  async def protected_b():
      return {&quot;Protected&quot;: True}
  </code></pre>