Easy everything in Backend Dev, page 9
OAuth2 Password Flow: Trading Credentials for a Token
The OAuth2 Password Flow trades a user's credentials for a temporary access token. It's used in trusted first-party apps, like a mobile app logging into its own backend, to avoid sending a password with every API call.
Password Hashing with Python's Passlib
Passlib turns plaintext passwords into secure, salted hashes that are safe to store. Use it in any Python app with user accounts to handle logins. The footgun: never compare hashes directly; always use the .verify() method to prevent timing attacks.
SQLAlchemy Declarative: Python Classes as Database Tables
SQLAlchemy's Declarative Mapping lets you define database tables as Python classes. You write a class with typed attributes, and SQLAlchemy generates the SQL. It's the standard way to use the ORM, turning database rows into Python objects.
SQLAlchemy Engine vs. Session: The Switchboard and the Call
Think of SQLAlchemy's Engine as the database switchboard (one per app) and a Session as a single, short-lived phone call (one per request). This pattern is standard in FastAPI for managing database connections.
The asyncio Event Loop: One Thread, Many Tasks
The asyncio event loop is a manager for a single-threaded process, juggling tasks to prevent idleness during slow I/O. It's the core of apps like FastAPI, handling network requests efficiently. The footgun is interacting with it directly; use asyncio.run().
FastAPI: Splitting Your App with `include_router`
app.include_router is like plugging a pre-wired power strip of API endpoints into your main FastAPI app. It lets you organize a large app into smaller files by feature, then combine them. The footgun is forgetting to add a URL prefix for each router.
FastAPI's APIRouter: Grouping Routes into Modules
Think of APIRouter as a mini-FastAPI app for organizing endpoints. It lets you group related paths, like all user routes, into a separate file. This is crucial for keeping large applications maintainable.
FastAPI's Dependency Caching: One Request, One Call
FastAPI dependencies are singletons for the life of a request. If multiple parts of your code ask for the same dependency (e.g., a database session), FastAPI runs it once, caches the result, and shares it. The footgun: this cache is per-request, not global.
FastAPI: Using Classes as Dependencies
Bundle related request parameters into a class instead of repeating them in every endpoint. FastAPI automatically creates an instance for you, cleaning up your code. This is ideal for shared logic like pagination. The footgun: FastAPI injects into __init__.
FastAPI's Depends: Let the Framework Handle Setup
Think of Depends as a pre-flight checklist for your API endpoints. You list required setup tasks, like getting a user or a database session, and FastAPI runs them for you. This is key for sharing logic like auth or database connections across many routes.
FastAPI: Returning HTML with HTMLResponse
Override FastAPI's default JSON output by using HTMLResponse to return a raw HTML string directly from an endpoint. It's for simple status pages or server-side rendered components.
FastAPI: Reading Request Cookies
FastAPI treats request cookies like any other parameter. Declare them directly in your endpoint's function signature using Cookie(), and the framework will extract the value for you. Use this for reading session IDs or user preferences.
Declaring Request Headers in FastAPI
Treat request headers like any other parameter in FastAPI. Declare them in your function signature to access values like User-Agent or X-Token. FastAPI automatically converts hyphens to underscores, so User-Agent is accessed via the user_agent…
FastAPI: Handling Form Data, Not Just JSON
FastAPI can handle classic HTML form data, not just JSON. Use Form to define expected fields in your endpoint, just like query parameters. It's ideal for login pages. The footgun: forgetting to pip install python-multipart will break form parsing.
Pydantic: Required vs. Optional Fields
In Pydantic, a field is required by default. To make it optional, you must provide a default value, like name: str = "guest" or age: int | None = None. This is key for flexible API request bodies.
Uvicorn Workers: Scaling Your FastAPI App
Uvicorn workers are like adding cashiers to a store. Instead of one process handling all requests, you run multiple, letting your FastAPI app use all CPU cores to serve more users concurrently.
FastAPI Query Parameters: Beyond the URL Path
In FastAPI, function arguments not in the URL path become query parameters—the optional key-value pairs after a URL's ?. Use them for filtering or pagination, like /items?skip=0&limit=10. The footgun: omitting a default value makes the parameter required.
Path Parameters: Turning URL Parts into Variables
Path parameters turn parts of a URL, like /users/123, into typed function arguments. FastAPI uses this to create endpoints for specific resources, like fetching a user by their ID. The footgun is forgetting type hints; without int, 123 is just a string.
FastAPI: Configure Endpoints with Decorators
FastAPI's path operation decorators configure an endpoint's metadata and behavior. Use them to set status codes (status_code=201), group endpoints with tags, or mark them as deprecated.
FastAPI Application Instance: Your API's Central Hub
The FastAPI instance is your API's central switchboard, connecting incoming requests to your code. You create it once (e.g., app = FastAPI()) and use its decorators like @app.get to define all your endpoints. The footgun is creating multiple instances.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles