FastAPI Azure Entra ID Auth

OAuth2 authorization code flow using MSAL, Starlette sessions, and raw asyncpg RBAC. Designed for the init-app-stack: FastAPI + Granian + asyncpg + uv + Python 3.14.

Why cookie-based auth

This approach stores the session in an encrypted cookie rather than a Bearer token. The key advantage: <a href="/api/files/report.pdf" download> links work out of the box. Browsers automatically send cookies on direct navigation — they cannot inject an Authorization header for <a> tag clicks. If you used token-based auth, file download links would require a JavaScript fetch + blob URL workaround instead.

Packages

uv add msal starlette pem
# starlette is already a fastapi dependency — just needs session middleware enabled