FastAPI Tutorial 2026 — Build Production-Ready REST APIs with Python

FastAPI Tutorial 2026 — Build Production-Ready REST APIs

There is a moment every Python developer experiences: they discover FastAPI and wonder how they ever lived without it.

FastAPI combines Python type hints with incredibly fast performance, automatic data validation, and interactive API documentation that generates itself. You write a Python function, add type hints, and FastAPI handles serialization, validation, error responses, and OpenAPI docs automatically. It is genuinely magical.

This tutorial takes you from installing FastAPI to deploying a production-ready API with authentication, database integration, and proper error handling.

Why FastAPI in 2026?

Before we write any code, let's be clear about what makes FastAPI special:

• Auto-generated docs: Interactive Swagger UI at /docs — ready instantly
• Type safety: Pydantic validates all input/output automatically
• Async-first: Built on Starlette with full async/await support
• Fast: One of the fastest Python frameworks — comparable to Node.js and Go
• Modern Python: Fully embraces type hints, f-strings, and Python 3.10+ features

FastAPI has become the standard choice for Python APIs in 2026 — used by Netflix, Microsoft, and hundreds of startups.

Setup

pip install fastapi uvicorn sqlmodel python-jose[cryptography] passlib[bcrypt]

• uvicorn — ASGI server to run FastAPI
• sqlmodel — Database ORM (SQLAlchemy + Pydantic, created by FastAPI's author)
• python-jose — JWT token handling
• passlib — Password hashing

Your First FastAPI App

# main.py
from fastapi import FastAPI

app = FastAPI(
    title="My API",
    description="A production-ready FastAPI application",
    version="1.0.0"
)

@app.get("/")
async def root():
    return {"message": "Hello, FastAPI!"}

@app.get("/health")
async def health_check():
    return {"status": "healthy"}

Run it:

uvicorn main:app --reload

Open http://localhost:8000/docs — you get a full interactive API explorer automatically.

Request and Response Models with Pydantic

Pydantic models define the shape of data coming in and going out. FastAPI validates everything automatically.

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel, EmailStr, Field
from typing import Optional
from datetime import datetime

app = FastAPI()

class UserCreate(BaseModel):
    name: str = Field(..., min_length=2, max_length=50)
    email: EmailStr
    age: int = Field(..., ge=18, le=120)
    bio: Optional[str] = Field(None, max_length=500)

class UserResponse(BaseModel):
    id: int
    name: str
    email: str
    created_at: datetime

    class Config:
        from_attributes = True

# In-memory store for demo
users_db: dict[int, dict] = {}
next_id = 1

@app.post("/users", response_model=UserResponse, status_code=201)
async def create_user(user: UserCreate):
    global next_id
    new_user = {
        "id": next_id,
        "name": user.name,
        "email": user.email,
        "created_at": datetime.utcnow(),
    }
    users_db[next_id] = new_user
    next_id += 1
    return new_user

@app.get("/users/{user_id}", response_model=UserResponse)
async def get_user(user_id: int):
    if user_id not in users_db:
        raise HTTPException(status_code=404, detail=f"User {user_id} not found")
    return users_db[user_id]

FastAPI will:

• Reject requests where age is under 18 (returns 422 with a clear error)
• Reject invalid email addresses automatically
• Return a 404 JSON error for missing users

Full CRUD API

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
from typing import Optional, List

app = FastAPI()

class Task(BaseModel):
    title: str
    description: Optional[str] = None
    completed: bool = False

class TaskUpdate(BaseModel):
    title: Optional[str] = None
    description: Optional[str] = None
    completed: Optional[bool] = None

class TaskResponse(Task):
    id: int

tasks: dict[int, TaskResponse] = {}
counter = 1

@app.get("/tasks", response_model=List[TaskResponse])
async def list_tasks(completed: Optional[bool] = None):
    result = list(tasks.values())
    if completed is not None:
        result = [t for t in result if t.completed == completed]
    return result

@app.post("/tasks", response_model=TaskResponse, status_code=201)
async def create_task(task: Task):
    global counter
    new_task = TaskResponse(id=counter, **task.model_dump())
    tasks[counter] = new_task
    counter += 1
    return new_task

@app.get("/tasks/{task_id}", response_model=TaskResponse)
async def get_task(task_id: int):
    if task_id not in tasks:
        raise HTTPException(status_code=404, detail="Task not found")
    return tasks[task_id]

@app.patch("/tasks/{task_id}", response_model=TaskResponse)
async def update_task(task_id: int, updates: TaskUpdate):
    if task_id not in tasks:
        raise HTTPException(status_code=404, detail="Task not found")
    task = tasks[task_id]
    update_data = updates.model_dump(exclude_unset=True)
    updated = task.model_copy(update=update_data)
    tasks[task_id] = updated
    return updated

@app.delete("/tasks/{task_id}", status_code=204)
async def delete_task(task_id: int):
    if task_id not in tasks:
        raise HTTPException(status_code=404, detail="Task not found")
    del tasks[task_id]

Database Integration with SQLModel

SQLModel combines SQLAlchemy (database ORM) and Pydantic (validation) into one clean model.

from fastapi import FastAPI, Depends, HTTPException
from sqlmodel import Field, Session, SQLModel, create_engine, select
from typing import Optional

DATABASE_URL = "sqlite:///./tasks.db"
engine = create_engine(DATABASE_URL, echo=True)

class Task(SQLModel, table=True):
    id: Optional[int] = Field(default=None, primary_key=True)
    title: str = Field(index=True)
    description: Optional[str] = None
    completed: bool = False

SQLModel.metadata.create_all(engine)

def get_session():
    with Session(engine) as session:
        yield session

app = FastAPI()

@app.post("/tasks", response_model=Task, status_code=201)
def create_task(task: Task, session: Session = Depends(get_session)):
    session.add(task)
    session.commit()
    session.refresh(task)
    return task

@app.get("/tasks", response_model=list[Task])
def list_tasks(session: Session = Depends(get_session)):
    return session.exec(select(Task)).all()

@app.get("/tasks/{task_id}", response_model=Task)
def get_task(task_id: int, session: Session = Depends(get_session)):
    task = session.get(Task, task_id)
    if not task:
        raise HTTPException(status_code=404, detail="Task not found")
    return task

JWT Authentication

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
from jose import JWTError, jwt
from passlib.context import CryptContext
from datetime import datetime, timedelta
from pydantic import BaseModel

SECRET_KEY = "your-secret-key-change-in-production"
ALGORITHM = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES = 30

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")

app = FastAPI()

fake_users = {
    "alice": {"username": "alice", "hashed_password": pwd_context.hash("secret123")}
}

def create_access_token(data: dict, expires_delta: timedelta) -> str:
    to_encode = data.copy()
    expire = datetime.utcnow() + expires_delta
    to_encode.update({"exp": expire})
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)

async def get_current_user(token: str = Depends(oauth2_scheme)):
    credentials_exception = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Invalid credentials",
        headers={"WWW-Authenticate": "Bearer"},
    )
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        username: str = payload.get("sub")
        if username is None:
            raise credentials_exception
    except JWTError:
        raise credentials_exception
    user = fake_users.get(username)
    if user is None:
        raise credentials_exception
    return user

@app.post("/token")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    user = fake_users.get(form_data.username)
    if not user or not pwd_context.verify(form_data.password, user["hashed_password"]):
        raise HTTPException(status_code=400, detail="Incorrect username or password")
    token = create_access_token(
        data={"sub": user["username"]},
        expires_delta=timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    )
    return {"access_token": token, "token_type": "bearer"}

@app.get("/me")
async def read_me(current_user: dict = Depends(get_current_user)):
    return {"username": current_user["username"]}

API Versioning, Routers, and Project Structure

Real applications split code across multiple files:

myapi/
├── main.py
├── routers/
│   ├── users.py
│   ├── tasks.py
│   └── auth.py
├── models/
│   ├── user.py
│   └── task.py
├── database.py
└── config.py

# routers/tasks.py
from fastapi import APIRouter, Depends, HTTPException
from sqlmodel import Session, select
from ..database import get_session
from ..models.task import Task

router = APIRouter(prefix="/tasks", tags=["tasks"])

@router.get("/", response_model=list[Task])
def list_tasks(session: Session = Depends(get_session)):
    return session.exec(select(Task)).all()

# main.py
from fastapi import FastAPI
from .routers import tasks, users, auth

app = FastAPI()
app.include_router(auth.router)
app.include_router(users.router)
app.include_router(tasks.router)

Testing FastAPI

Good APIs need good tests — see our Python testing with pytest guide for comprehensive testing strategies.

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

def test_create_task():
    response = client.post("/tasks", json={"title": "Learn FastAPI", "completed": False})
    assert response.status_code == 201
    data = response.json()
    assert data["title"] == "Learn FastAPI"
    assert "id" in data

def test_get_nonexistent_task():
    response = client.get("/tasks/99999")
    assert response.status_code == 404

Deploying FastAPI

# Dockerfile
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

For small projects, deploy to Railway, Render, or Fly.io — all support Python and Docker with free tiers. For production scale, use AWS ECS or Google Cloud Run.

FastAPI vs Django — Quick Decision Guide

If you are torn between FastAPI and Django, read our Django vs FastAPI 2026 comparison for a full breakdown. Quick summary:

• FastAPI: Build a pure API, microservice, or AI backend
• Django: Build a full web app with admin panel, user management, and templates

FastAPI is the right choice for modern API development in 2026. It is fast to write, fast to run, and delightful to maintain. Build something with it today.

Get FastAPI project templates and API design guides in the AiTechWorlds Telegram channel!