SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

I also get a 403 forbidden error when trying to call my FastAPI backend, but presume that's because the user is logged in but not yet verified.

Hey. If the user is not logged in, you get a 401 error. Not 403.

Thanks - would I get a 403 error if the user is logged in but hasn't verified their email yet?

Ah right. I misread your original message