The FastAPI project has published release 0.144.0, a focused update that brings WebSocket support to security dependencies. Until now, security helpers such as OAuth2PasswordBearer, API key schemes, and custom dependency functions composed from Security() were primarily wired into HTTP path operations. This release closes that gap by letting the same dependency machinery guard WebSocket connections.
- Added WebSocket support to security dependencies, contributed in PR
#10147by @mnixry. Security dependencies can now be resolved in WebSocket route handlers the same way they are for regular HTTP endpoints. - This builds on FastAPI's existing
Depends()andSecurity()system, so declared security schemes and their dependencies remain consistent across HTTP and WebSocket code paths.
In practice, this means a developer can declare a security scheme once and reuse it when authenticating a WebSocket handshake or connection handler, rather than writing a separate ad-hoc check. Applications that previously had to duplicate token parsing or key validation logic for WebSocket routes can now centralise it in the same dependency graph they already use elsewhere. Because WebSockets maintain long-lived connections, validating credentials during the initial dependency resolution keeps the authentication flow predictable and aligned with how protected HTTP routes behave.
For developers, the change reduces boilerplate in real-time features such as live dashboards, chat endpoints, or streaming APIs, where a route may need the same authentication rules as the rest of the app. It also keeps the security surface easier to audit, since WebSocket endpoints no longer need separate guard code outside FastAPI's standard dependency injection. As a minor release, 0.144.0 should be a low-risk upgrade for existing projects, and teams relying on WebSockets alongside protected REST endpoints are the primary beneficiaries.
Source: https://github.com/fastapi/fastapi/releases/tag/0.144.0