Skip to content

Examples

Each example is a small, complete FastAPI app in the repository's examples/ folder, written the way the tools are meant to be used in production, and tested with the library on every change. They keep their state in memory so that they run without any server; in production, Redis or Valkey lets every process share it. Only the background work needs one.

  • A browser app

    Server-side sessions, CSRF protection and security headers for a cookie-based app.

  • API keys, tokens and codes

    Keys stored as digests with scopes, one-time login codes and revoked tokens.

  • Passkeys

    A site without passwords: sign-ups and logins by passkey, and the devices each user is logged in on.

  • Second factor

    An authenticator app after the password, recovery codes, and a recent code to delete the account.

  • Accounting

    Searches and tokens metered per tenant, held to its plan, each charge a record for billing.

  • Audit trail

    Who changed or deleted which account, refusals included, signed and chained.

  • Authentication strategies

    An app per strategy: JWTs, logins with GitHub, sessions, bearer tokens, SAML single sign-on and API keys; and three of them on one app.

  • Authorization

    A newsroom whose Casbin policy says who reads, writes, publishes and grants roles, a team's documents whose Cedar policies decide by their attributes, and a shop whose refunds Open Policy Agent decides, asked over the network.

  • Background work

    Scheduled jobs, a leader among processes and a task queue on Redis streams.

  • Checking uploads

    The real type of a file from its bytes, size and pixel limits, and safe names.

  • Errors and observability

    Problem details, request IDs in logs and responses, deadlines and health checks.

  • Idempotency keys

    A retried payment gets the first response instead of charging twice.

  • Operations

    Maintenance mode, feature flags and circuit breakers, switched at runtime.

  • Pagination

    An app per strategy, from page numbers to scrolls and streams; and a catalogue cached three ways.

  • Rate and concurrency limits

    Requests per client and per user, shared budgets, and at most N expensive calls at a time.

  • Response cache

    Shared entries for public pages, private ones per user, invalidation by tag and get_or_set.

  • Webhooks in and out

    Signed webhooks received without replays, and sent to user URLs without SSRF.

Running them

From a clone of the repository, each one starts with uvicorn:

git clone https://github.com/nonodev96/fastapi-alcazaba.git
cd fastapi-alcazaba
make deps                 # .venv, with every extra
source .venv/bin/activate
uvicorn examples.cache.main:app

Then open http://127.0.0.1:8000/docs to try its endpoints from the browser. The keys and secrets they need come from environment variables, with a throwaway value for trying them out: set real ones in production.