Developer Builds Production-Grade IAM Service Using FastAPI With MFA and Token Security

A developer has published a detailed writeup on AuthCore, a production-style Identity and Access Management API built with FastAPI, PostgreSQL, Redis, and Celery. The project implements refresh token families, where reuse of an old token triggers full family revocation and an audit event to detect potential session hijacking. Multi-factor authentication is handled via TOTP, requiring a separate short-lived challenge token before full access tokens are issued after login. Security measures include bcrypt password hashing, HaveIBeenPwned breach checking via k-anonymity, Redis-based account lockout, and role-based access control. The project also features a CI pipeline using GitHub Actions with linting, test coverage gates, and Trivy container vulnerability scanning.