# Guide

Everything in `fastapi-multiauth` is built from one idea: a **source** knows *where* a credential lives in a request, and a **validator** you write decides *who* it belongs to.

```
flowchart LR
    R[Request] --> E{"source finds a credential?"}
    E -- no --> N[401]
    E -- yes --> V[your validator]
    V -- returns a user --> H[your route]
    V -- raises --> X[401 / 403]
```

A source is a FastAPI dependency: pass it to `Security()` and your route receives what the validator returned. It also declares itself in OpenAPI, so `/docs` shows the right **Authorize** dialog.

The library never stores anything and never looks at your user model. Deciding what a valid credential means is always your validator's job.

## The sources

| Source | Reads | Page |
| --- | --- | --- |
| `HTTPBearerAuth` | `Authorization: Bearer ...` | [Bearer tokens](<https://fastapi-multiauth.d3vyce.fr/guide/bearer-tokens/index.md>) |
| `APIKeyCookieAuth` | a cookie, optionally signed | [Cookie sessions](<https://fastapi-multiauth.d3vyce.fr/guide/cookie-sessions/index.md>) |
| `APIKeyHeaderAuth` | a named header | [API keys and Basic](<https://fastapi-multiauth.d3vyce.fr/guide/api-keys-and-basic/index.md>) |
| `APIKeyQueryAuth` | a query parameter | [API keys and Basic](<https://fastapi-multiauth.d3vyce.fr/guide/api-keys-and-basic/index.md>) |
| `HTTPBasicAuth` | `Authorization: Basic ...` | [API keys and Basic](<https://fastapi-multiauth.d3vyce.fr/guide/api-keys-and-basic/index.md>) |
| `OAuth2...BearerAuth`, `OpenIdConnectAuth` | a token from your identity provider | [JWT and OAuth 2.0](<https://fastapi-multiauth.d3vyce.fr/guide/jwt-and-oauth2/index.md>) |
| `HTTPDPoPAuth` | `Authorization: DPoP ...` and its proof | [JWT and OAuth 2.0](<https://fastapi-multiauth.d3vyce.fr/guide/jwt-and-oauth2/#sender-constrained-tokens-dpop>) |
| `HMACSignatureAuth` | a signed request body, from a webhook sender | [Signed webhooks](<https://fastapi-multiauth.d3vyce.fr/guide/webhooks/index.md>) |

Need something else? Write a [custom source](<https://fastapi-multiauth.d3vyce.fr/guide/custom-sources/index.md>).

Start with [Validators](<https://fastapi-multiauth.d3vyce.fr/guide/validators/index.md>).