I am writing a fastapi web app which gets authenticated using OKTA iDP with SAML 2.0 SSO. I want to protect my APIs in web app. I know fastapi has only Oauth2/token based API protection instead of cookie or session based. However, we receive only session info(session index) from IDP after successful authentication. How can I protect api in my web app by using this session index info? Is there any way to convert received session into token and save this in fastapi app to use for protection? Or please suggest me other way?

from fastapi import FastAPI

app = FastAPI()


@app.login("/sso/login")
async def login():
    # got sessionindex from Okta IDP
    return session

@app.logout("/sso/logout")
async def logout():
    # delete session received from Okta IDP on logout
    return
    
@app.get_graph()               <----------------------
async def get_graph():
    # how can i protect this api. so that i can access only
    # on successful authentication?
    return