Building Production APIs with Python

Most FastAPI tutorials end where production begins.

There's a gap — sometimes a chasm — between an API that works on a developer's laptop and an API that works at three in the morning under a load spike with one of the database replicas down. Most tutorials live on one side of that gap. This book lives on the other.

FastAPI makes it pleasant to write the laptop version of an API: type hints become validation, docstrings become documentation, async functions become a real concurrency story. The framework removes so much friction that you can ship a working endpoint in twenty minutes. That is its great strength and, paradoxically, its trap — because shipping the laptop version to production is how every team rediscovers the same handful of issues: secrets in source files, an authentication flow that works only for the happy path, a cache invalidation strategy that turns into a herd of database queries the moment Redis blinks, a test suite that can't be run in CI, a deployment story that consists of one engineer who knows how to do it.

This book attacks those failure modes head-on.

Across twelve chapters and a single continuing project — the Articles & Users API — you build a service that has every capability production demands and none of the demo-code shortcuts that fail under real load. The project starts in Chapter 2 as a single file with two endpoints. By Chapter 12 it is a containerized service with JWT authentication, refresh-token rotation, optional MFA, per-user rate limiting, a two-tier cache, two API versions running in parallel, OpenAPI documentation, a passing test suite, an observability stack, and Kubernetes manifests.

What you'll build:

• A typed, async-native API using FastAPI 0.115+ and Pydantic v2
• JWT authentication with refresh-token rotation and reuse detection
• Multi-factor auth (TOTP) with hashed backup codes
• Role-based access control and API key authentication
• Redis-backed rate limiting that actually pipelines correctly
• Cache-aside with stampede protection — the failure mode no tutorial mentions
• Two API versions running side-by-side with a real deprecation lifecycle
• OpenAPI documentation consumers can actually use
• A test suite using modern httpx with ASGITransport
• Performance work backed by profiling, not guesswork
• A production deployment with Docker, Kubernetes, OpenTelemetry, and graceful shutdown

This book is for you if:

• You're comfortable with Python and HTTP basics, but want to ship something beyond a tutorial demo
• You've built an API that worked in development and broke in production — and want the patterns that prevent that
• You're tired of fragmented blog posts that show pieces but never the integrated whole
• You want one continuous project that grows from a single endpoint into a deployable service

What this book is not:

An exhaustive FastAPI reference, a Python tutorial, or a microservices manifesto. It's an opinionated field guide that names tradeoffs, picks sides, and ends every chapter pointing at what comes next.

Stack (pinned in Appendix C):

Python 3.12, FastAPI 0.115+, Pydantic 2.9+, SQLAlchemy 2.0 async, PyJWT, Redis 5+, httpx 0.27+, pytest 8+. Every example was tested against this exact stack.

The companion code is free.

Download the complete Articles & Users API repository — including Dockerfile, docker-compose stack, Kubernetes manifests, and a passing test suite — at the link printed on the About page.

Take what is useful, argue with what is not, and ship the thing.