FastAPI

fastapiBackend46 lines

Python API with typed request validation and generated OpenAPI docs.

Current — as published in v1.3.2. Written by hand for FastAPI, not generated.

The rule

Types are the contract

Every request body is a Pydantic model. Never `dict` or `Any` — that throws away validation, documentation and type safety at once.
Every endpoint declares a response model, or internal fields leak to clients.
Annotate return types. They are checked and documented.

Async

No blocking I/O inside async def. A synchronous driver or requests call stalls the event loop for every other request.
If a library is synchronous, declare the handler def and let FastAPI use a threadpool.

Configuration

One Settings object via pydantic-settings, validated at import. Scattered os.getenv calls fail at request time instead of at boot.
Secrets come from the environment, never from source.

Auth

Enforce with dependencies (Depends), so it is declarative and cannot be forgotten on a new endpoint.
Never trust a user id from the request body — derive it from the verified token.

Structure

text

app/
  api/         routers
  models/      Pydantic models
  services/    business logic
  db/          database access

Handlers stay thin: validate, delegate to a service, return a model.

Never

Never return an ORM object directly; map it to a response model.
Never use allow_origins=["*"] together with credentials.
Never log secrets, tokens or personal data.

As each tool receives it

The same guidance, in the shape each editor reads. Cursor and Claude Code are written separately by hand; the rest are derived from the Cursor rule.

→ .cursor/rules/fastapi.mdchand-written for this tool

.cursor/rules/fastapi.mdc

---
description: FastAPI conventions
globs: ["app/**/*.py", "**/*.py"]
alwaysApply: false
---

# FastAPI

## Types are the contract

- Every request body is a Pydantic model. **Never `dict` or `Any`** — that
  throws away validation, documentation and type safety at once.
- Every endpoint declares a response model, or internal fields leak to clients.
- Annotate return types. They are checked and documented.

## Async

- No blocking I/O inside `async def`. A synchronous driver or `requests` call
  stalls the event loop for every other request.
- If a library is synchronous, declare the handler `def` and let FastAPI use a
  threadpool.

## Configuration

- One `Settings` object via `pydantic-settings`, validated at import. Scattered
  `os.getenv` calls fail at request time instead of at boot.
- Secrets come from the environment, never from source.

## Auth

- Enforce with dependencies (`Depends`), so it is declarative and cannot be
  forgotten on a new endpoint.
- Never trust a user id from the request body — derive it from the verified
  token.

## Structure

```
app/
  api/         routers
  models/      Pydantic models
  services/    business logic
  db/          database access
```

Handlers stay thin: validate, delegate to a service, return a model.

## Never

- Never return an ORM object directly; map it to a response model.
- Never use `allow_origins=["*"]` together with credentials.
- Never log secrets, tokens or personal data.

What else this module writes

Selecting FastAPI contributes more than a rule file — all of it merged with every other module you pick, with conflicts resolved rather than duplicated.

Environment

DATABASE_URLrequiredConnection string. Full read and write access — never in a client.

SECRET_KEYrequiredSigns tokens and sessions. Rotating it invalidates every existing session.

ALLOWED_ORIGINSrequiredComma-separated origins allowed by CORS. Never `*` alongside credentials.

LOG_LEVELoptionalLogging verbosity.

Folders

app/api/app/models/app/services/app/db/app/tests/

conflicts withSupabase conflicts withFirebase conflicts withNestJS

Put this in your repo

Adds FastAPI to a project this tool generated, without starting over. Files you have hand-edited are left alone.