# Recipes

Complete, copy-paste patterns adapted from a production app. Each one is a runnable file, tested with the library.

| Recipe | What it builds |
| --- | --- |
| [Sessions and API tokens](<https://fastapi-multiauth.d3vyce.fr/recipes/sessions-and-tokens/index.md>) | a web app and its API on the same routes |
| [Personal access tokens](<https://fastapi-multiauth.d3vyce.fr/recipes/personal-access-tokens/index.md>) | users create, list and revoke their own tokens |
| [Role-gated routes](<https://fastapi-multiauth.d3vyce.fr/recipes/role-gated-routes/index.md>) | admin-only endpoints from one validator |
| [Sign out everywhere](<https://fastapi-multiauth.d3vyce.fr/recipes/sign-out-everywhere/index.md>) | a device list with per-session revocation |
| [Two-factor login](<https://fastapi-multiauth.d3vyce.fr/recipes/two-factor/index.md>) | TOTP codes, a pending-login cookie and recovery codes |
| [Sign in with OpenID Connect](<https://fastapi-multiauth.d3vyce.fr/recipes/oidc-sign-in/index.md>) | "Log in with Google / Keycloak / Entra" |
| [WebSocket tickets](<https://fastapi-multiauth.d3vyce.fr/recipes/websocket-tickets/index.md>) | authenticating browser WebSockets without cookies |
| [Audit your routes](<https://fastapi-multiauth.d3vyce.fr/recipes/audit-routes/index.md>) | a CI test that fails on unguarded routes |