Advanced FastAPI and Production Deployment

Make FastAPI services production-ready: OAuth2 and JWT authentication with hashed passwords, SQLAlchemy and Alembic, background work, thorough tests, and Docker images served by Uvicorn workers behind Nginx.

Advanced · Software Development · about 18 hours · 5 modules · certificate on completion

Taught by Chaiyapòn Srisomboòn, Mouhamadouù Bâ, AI Learning Companions.

About this course

Getting a FastAPI app to answer on localhost is the easy part. This course covers what it takes to run one for real users. You'll secure it with the OAuth2 password flow, passwords stored only as Argon2 hashes and expiring JSON Web Tokens, with dependencies that keep each user's data their own; persist it with SQLAlchemy 2.0 and evolve the schema with Alembic migrations; keep responses fast with background tasks and know when a task queue such as Celery is the better tool; and test the whole service against isolated databases with dependency overrides. Then you'll make it production-shaped: configuration and secrets from the environment, JSON logs with request IDs, liveness and readiness checks, a non-root Docker image, Uvicorn or Gunicorn workers, and Nginx in front with the forwarded headers set up correctly.

The labs build one service, TaskHub, step by step, with starter files, TODOs and the real output of every command, from alembic upgrade to a request logged through the proxy, checked against current FastAPI, SQLAlchemy 2.1, PyJWT and pwdlib. The capstone takes your own task API all the way to a secure, tested, containerised deployment.

What you'll learn

  • Secure an API with the OAuth2 password flow, Argon2-hashed passwords and short-lived JWT access tokens
  • Persist data with SQLAlchemy 2.0 and a session per request, and change the schema safely with Alembic migrations
  • Move slow work off the request path with background tasks and task queues, without blocking the event loop
  • Test endpoints, authentication, ownership and background work with TestClient, dependency overrides and isolated databases
  • Package the service in a Docker image configured by environment variables, with structured logs and health checks
  • Run it with Uvicorn or Gunicorn workers behind Nginx, with the forwarded headers and root path it needs

Skills you'll gain

OAuth2 and JWT authentication, Password hashing (Argon2), SQLAlchemy 2.0 ORM, Alembic migrations, Background tasks and job queues, API testing with pytest, Docker, Configuration with pydantic-settings, Structured logging, Reverse proxies (Nginx)

Tools

FastAPI, SQLAlchemy, Alembic, PyJWT, pytest, Docker, Uvicorn, Nginx

Before you start

Introduction to FastAPI and Modern Web Services, or the same experience: routers, Pydantic models and dependencies. Comfort with pytest (CI/CD and Automated Testing covers it) and basic SQL. You need Python 3.11 or later, a terminal with curl, and Docker with Docker Compose for the last lab; Containerisation and Orchestration with Docker and Kubernetes is useful background but not required.

Modules

  1. Security and Authentication (JWT/OAuth2)

    Secure an API the way FastAPI's security tools are designed for: the OAuth2 password flow with bearer tokens, passwords stored only as Argon2 hashes, signed JSON Web Tokens that expire, and dependencies that check who the caller is and what they may do.

    • OAuth2, tokens and the password flow (12 min)
    • Hashing passwords (11 min)
    • JSON Web Tokens (13 min)
    • Protecting routes: current user, roles and scopes (12 min)
    • Hands-on lab: Add OAuth2 and JWT authentication

  2. Database Integration (SQLAlchemy)

    Persist data properly: SQLAlchemy 2.0's typed models, one session per request through a dependency, ownership enforced in queries, schema changes managed with Alembic migrations, and when async database access is worth it.

    • SQLAlchemy 2.0: engines, models and sessions (13 min)
    • Sessions as dependencies, and layers (12 min)
    • Migrations with Alembic (12 min)
    • Async database access (11 min)
    • Hands-on lab: Persist tasks with SQLAlchemy and Alembic

  3. Asynchronous Operations & Background Tasks

    Keep responses fast without losing work: what really blocks the event loop and how to avoid it, lifespan set-up and shutdown, BackgroundTasks for short jobs after the response, and task queues such as Celery for work that must survive restarts.

    • The event loop, blocking code and lifespan (12 min)
    • BackgroundTasks (11 min)
    • Task queues: Celery and friends (12 min)
    • Hands-on lab: Background work done right

  4. Testing FastAPI Applications

    Test the whole service with confidence: TestClient against the real app, dependency overrides for the database, settings and outside services, isolated in-memory databases, async tests, and coverage.

    • TestClient and test structure (12 min)
    • Overriding dependencies (12 min)
    • Isolated test databases and async tests (12 min)
    • Hands-on lab: Test the API end to end

  5. Production Deployment

    Run the service for real: configuration and secrets from the environment, a Docker image built for production, workers, performance and structured logs, and deployment behind an Nginx reverse proxy with health checks.

    • Configuration and secrets (11 min)
    • Docker images for FastAPI (13 min)
    • Workers, performance and logging (12 min)
    • Behind a reverse proxy, with health checks (13 min)
    • Hands-on lab: Containerise TaskHub and serve it behind Nginx

Project: Ship a secure, containerised task API

Take the task management API you built in Introduction to FastAPI and Modern Web Services, or TaskHub from this course, to production quality. Add accounts with the OAuth2 password flow, Argon2-hashed passwords and short-lived JWT access tokens; every user sees only their own projects and tasks, and an admin role can list users. Store everything with SQLAlchemy 2.0, with Alembic migrations that build the schema from an empty database: SQLite by default, and PostgreSQL when the database URL points to it (as an optional third Compose service). Keep report jobs in the database, so they survive restarts and work with several workers, and send notifications with background tasks. Test it thoroughly against an isolated database with dependency overrides. Configure it entirely from environment variables, log JSON lines with request IDs, expose /health and /ready, package it in a Docker image that runs as a non-root user, and serve it with Uvicorn or Gunicorn workers behind Nginx with Docker Compose. Optionally, deploy the same image to a Linux server or a cloud platform of your choice, with HTTPS.

Part of

The products this course names are trademarks of their owners, who haven't made or endorsed it.

Start the course free