# Simple OAuth2 con Password y Bearer

Ahora vamos a construir a partir del capítulo anterior y agregar las partes faltantes para tener un flujo de seguridad completo.

## Obtener el `username` y `password`

Vamos a usar las utilidades de seguridad de **FastAPI** para obtener el `username` y `password`.

OAuth2 especifica que cuando se utiliza el "password flow" (que estamos usando), el cliente/usuario debe enviar campos `username` y `password` como form data.

index-02-redoc-simple.png...

index-01-swagger-ui-simple.png...

Aleksandr Andrukhov <******@****.***> 1733828020 +0300

Lee Yesong (이예송) <******@****.***> 1739618352 +0900

Sebastián Ramírez <******@****.***> 1731896744 +0100

Sebastián Ramírez <******@****.***> 1731896744 +0100

    val multipart =
      """
      |--simple boundary
      |
      |abcd
      |--simple boundary--
      """.trimMargin()
        .replace(Regex("(?m)simple boundary$"), "simple boundary \t \t")
        .replace("\n", "\r\n")

    val parts =
      MultipartReader(
        boundary = "simple boundary",
        source = Buffer().writeUtf8(multipart),
      )

## Declaring types { #declaring-types }

You just saw the main place to declare type hints. As function parameters.

This is also the main place you would use them with **FastAPI**.

### Simple types { #simple-types }

You can declare all the standard Python types, not only `str`.

You can use, for example:

* `int`
* `float`
* `bool`
* `bytes`

---

But for this example, we'll use a very simple HTML document with some JavaScript, all inside a long string.

This, of course, is not optimal and you wouldn't use it for production.

In production you would have one of the options above.

But it's the simplest way to focus on the server-side of WebSockets and have a working example: