Habit-tracking API built with FastAPI, does the auth flow hold up?

Structurally fine, one real issue: verify_token catches JWTError but not ExpiredSignatureError separately, so an expired token currently returns a 500 instead of a 401. Split the except:

except ExpiredSignatureError:
    raise HTTPException(401, "token expired")
except JWTError:
    raise HTTPException(401, "invalid token")

Also your refresh tokens don't have a revocation check, fine for now at this scale, just know it's there if you ever need to log someone out remotely.