<img src="/img/tutorial/security/image01.png">

!!! check "Authorize button!"
    You already have a shiny new "Authorize" button.

    And your *path operation* has a little lock in the top-right corner that you can click.

And if you click it, you have a little authorization form to type a `username` and `password` (and other optional fields):

<img src="/img/tutorial/security/image02.png">

!!! note

    !!! tip
        Prefer to use the `Annotated` version if possible.

    ```Python hl_lines="2  6  10"
    {!> ../../../docs_src/security/tutorial006.py!}
    ```

When you try to open the URL for the first time (or click the "Execute" button in the docs) the browser will ask you for your username and password:

<img src="/img/tutorial/security/image12.png">

## Check the username

Here's a more complete example.

!!! tip "Tipp"
    Wenn Sie in Ihren Tests neben dem Senden von Anfragen an Ihre FastAPI-Anwendung auch `async`-Funktionen aufrufen möchten (z. B. asynchrone Datenbankfunktionen), werfen Sie einen Blick auf die [Async-Tests](../advanced/async-tests.md){.internal-link target=_blank} im Handbuch für fortgeschrittene Benutzer.

## Tests separieren

        <span class="sponsor-badge">sponsor</span>
        <img class="sponsor-image" src="/img/sponsors/platform-sh-banner.png" />
      </a>
    </div>
    <div class="item">
      <a title="Deploy FastAPI on AWS with a few clicks" style="display: block; position: relative;" href="https://www.porter.run" target="_blank">
        <span class="sponsor-badge">sponsor</span>
        <img class="sponsor-image" src="/img/sponsors/porter-banner.png" />
      </a>

    title: "Build, run and scale your apps on a modern, reliable, and secure PaaS."
    img: https://fastapi.tiangolo.com/img/sponsors/platform-sh.png
  - url: https://www.porter.run
    title: Deploy FastAPI on AWS with a few clicks
    img: https://fastapi.tiangolo.com/img/sponsors/porter.png
  - url: https://bump.sh/fastapi?utm_source=fastapi&utm_medium=referral&utm_campaign=sponsor
    title: Automate FastAPI documentation generation with Bump.sh

		* E se o token for roubado, o risco é menor. Não é como se fosse uma chave permanente que vai funcionar para sempre (na maioria dos casos).
	* O frontend armazena aquele token temporariamente em algum lugar.
	* O usuário clica no frontend para ir à outra seção daquele frontend do aplicativo web.
	* O frontend precisa buscar mais dados daquela API.
		* Mas precisa de autenticação para aquele endpoint em específico.