A conceptual skill for securing FastAPI REST APIs with JWT authentication
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/22/2026
What it changes
Passed 0 of 22 test cases with the skill, and 22 of 22 without it.
Without skill100%
With skill0%
Checks it passed that the model alone missed
Uses "Could not validate credentials" as the error message detail for HTTP 401 authentication failures.
Uses "Access forbidden: Insufficient permissions" as the detail message when role check fails with HTTP 403.
2 fixed16 passed either way3 still failing1 broke
Pass-rate lift
-100 pp
Tokens
+20%
Agent turns
0%
Response time
-23%
Model gemini-3.6-flashMeasured 8/22/2026v118 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
I am building a FastAPI REST backend and need to protect user profile routes so that logged-in users can only access their own resources. Could you write a security dependency in Python that inspects the Authorization header, validates the JWT signature and expiration claim, and verifies identity matching? Ensure it raises proper HTTP status exceptions when authentication fails or permissions are missing.
What was checked, without and with the skill
Checked
Without skill
With skill
Uses "Could not validate credentials" as the error message detail for HTTP 401 authentication failures.
Missed
Passed
Raises an HTTP 403 exception when the authenticated user ID does not match the requested resource ID.
Passed
Passed
case-01 · gemini-3.6-flash · 8/22/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md127 linessingle file
API JWT Authenticator Skill
When to Use This Skill
Use this conceptual skill when you need to implement secure JWT-based authentication for FastAPI REST APIs. This skill is appropriate for:
Protecting API endpoints that require user authentication
Enforcing user-specific access control (ensuring users can only access their own resources)
Implementing stateless authentication in microservices
Securing REST APIs with standard JWT token validation
Adding role-based access control (RBAC) to API endpoints
This skill should NOT be used for:
Public APIs that don't require authentication
APIs that use alternative authentication methods (OAuth, API keys, etc.)
Simple applications where basic auth is sufficient
Prerequisites
Understanding of JWT (JSON Web Token) concepts
FastAPI application framework knowledge
Basic security principles and authentication patterns
Environment for managing secret keys securely
Conceptual Implementation Framework
JWT Token Extraction Capability
Extract JWT tokens from the Authorization header in the format "Bearer "
Handle malformed or missing authorization headers appropriately
Validate the presence of the "Bearer" prefix in the header
Token Validation Capability
Validate JWT tokens using a shared secret key
Verify token signature to ensure integrity
Check token expiration (exp) claim to prevent usage of expired tokens
Validate token issuer (iss) and audience (aud) claims when applicable
User Identity Verification Capability
Extract user identity information from the token payload
Compare the user ID in the token with the requested resource