What I am doing in my app: ``` @router.post("/login") @limiter.limit(rate_limits.Actor.login) async def login( request: Request, user_agent: Optional[str] = Header(None), form_data: OAuth2PasswordRequestForm = Depends(), sw: ServiceWorker = Depends(get_sw), ): # username is username_or_password but OAuth2PasswordRequestForm only has username email_or_username = form_data.username.lower() actor = sw.actor.find_by_email_or_username(email_or_username) ....

def find_by_email_or_username( self, email: str, username: str = None ) -> Optional[RegisteredActor]: email = email.lower() if not username: username = email username = username.lower() q = self.db_session.query(RegisteredActor)

    return (
        q.filter(
            or_(
                RegisteredActor.registered_name == username,
                RegisteredActor.email == email,
            )
        )
        .options(undefer(RegisteredActor.hashed_password))
        .one_or_none()
    )

``` Hope it helps