API Key vs 단기 Token — 누설 위험으로 선택

# Server 쪽 — 한 endpoint 에 장기 API key 와 단기 token 둘 다 받음
from fastapi import FastAPI, Depends, HTTPException, status, Header
from typing import Annotated

app = FastAPI()

# 가상 store; production: DB + Redis
_api_keys: set[str] = {'sk_live_abc123_owned_by_org_xyz'}
_active_tokens: dict[str, str] = {'tok_short_lived_xyz': 'u_42'}

async def authenticate(
    authorization: Annotated[str | None, Header()] = None,
) -> dict:
    if not authorization or not authorization.startswith('Bearer '):
        raise HTTPException(401, detail='Bearer 필수',
                            headers={'WWW-Authenticate': 'Bearer'})
    credential = authorization.removeprefix('Bearer ').strip()

    # API key 먼저 시도 (장기, server-to-server)
    if credential in _api_keys:
        return {'kind': 'api_key', 'identity': 'org_xyz'}

    # 단기 token 으로 fallback (user 세션)
    if credential in _active_tokens:
        return {'kind': 'session_token', 'identity': _active_tokens[credential]}

    raise HTTPException(401, detail='알 수 없는 자격 증명',
                        headers={'WWW-Authenticate': 'Bearer'})

@app.get('/account')
async def me(auth = Depends(authenticate)):
    return auth

# 단기 token 발급 + refresh
import secrets, time
from fastapi import FastAPI, HTTPException

app = FastAPI()
_users: dict[str, dict] = {'pippa': {'password_hash': '...', 'id': 'u_42'}}
_tokens: dict[str, dict] = {}  # token -> {user_id, issued_at, expires_at}
_refresh: dict[str, str] = {}  # refresh_token -> user_id

@app.post('/login')
async def login(payload: dict):
    user = _users.get(payload['username'])
    if not user or not verify_password(payload['password'], user['password_hash']):
        raise HTTPException(401, detail='잘못된 자격 증명')

    access = secrets.token_urlsafe(32)
    refresh = secrets.token_urlsafe(32)
    now = time.time()
    _tokens[access]  = {'user_id': user['id'], 'issued_at': now, 'expires_at': now + 900}     # 15분
    _refresh[refresh] = user['id']  # 실생활 30일 — expiry 같이 저장
    return {'access_token': access, 'refresh_token': refresh, 'expires_in': 900}

@app.post('/refresh')
async def refresh_endpoint(payload: dict):
    user_id = _refresh.get(payload['refresh_token'])
    if not user_id:
        raise HTTPException(401, detail='잘못된 refresh token')
    new_access = secrets.token_urlsafe(32)
    now = time.time()
    _tokens[new_access] = {'user_id': user_id, 'issued_at': now, 'expires_at': now + 900}
    return {'access_token': new_access, 'expires_in': 900}

# Client — access token 만료 시 조용히 refresh
import httpx, time

class SessionClient:
    def __init__(self, base_url: str, access: str, refresh: str, expires_in: int):
        self.base = base_url
        self.access = access
        self.refresh = refresh
        self.expires_at = time.time() + expires_in - 30  # 30초 안전 여유
        self.client = httpx.Client(base_url=base_url)

    def _refresh_if_needed(self):
        if time.time() < self.expires_at:
            return
        resp = self.client.post('/refresh', json={'refresh_token': self.refresh})
        resp.raise_for_status()
        data = resp.json()
        self.access = data['access_token']
        self.expires_at = time.time() + data['expires_in'] - 30

    def get(self, path: str):
        self._refresh_if_needed()
        return self.client.get(path, headers={'Authorization': f'Bearer {self.access}'})