Loading repository data…
ClusterSandbox / repository
A FastAPI boilerplate with JWT and API-key auth, Redis caching, SQLAlchemy, Alembic migrations, logging, rate-limiting.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
A lightweight FastAPI boilerplate to start APIs quickly. This project provides a small, opinionated starter kit with authentication helpers, API key support, rate limiting primitives, Redis integration and Alembic migrations so you can begin building production-ready APIs fast.
api/routers) for auth, users and API keysapi/oauth2.py) and auth routerpython -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
Create a .env file at the project root (the project uses pydantic-settings to load .env). The project expects at least the following variables (see core/config.py):
postgresql://user:pass@localhost:5432/dbnameHS256)127.0.0.1)6379)Example .env (do not commit credentials):
DATABASE_URL=postgresql://postgres:password@localhost:5432/fastapi_db
SECRET_KEY=your-long-secret-key
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=60
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
RATE_LIMIT_PER_HOUR=1000
USER_RATE_LIMIT_PER_HOUR=500
MAX_FAILED_ATTEMPTS=5
LOCKOUT_DURATION_SECONDS=3600
HEARTBEAT_INTERVAL_SECONDS=60
The repo includes an alembic folder. Create your database, then generate and run migrations:
Selected from shared topics, language and repository description—not editorial ratings.
ankushjain2001 /
A minimal FARM stack boilerplate / template project to get you started with a Python FastAPI backend, React frontend, MongoDB, and JWT user authentication (via FastAPIUsers).
62/100 healthkaanari-tech /
FastAPI REST boilerplate is a comprehensive starting point for developing robust web applications. It provides a structured foundation equipped with essential features and configurations.
41/100 health# create a migration (after editing/adding models)
alembic revision --autogenerate -m "create initial tables"
# apply migrations
alembic upgrade head
Start the app with uvicorn from the project root:
uvicorn api.main:app --reload --host 0.0.0.0 --port 8000
Open http://127.0.0.1:8000/docs for the interactive FastAPI docs.
api/ - FastAPI application package
main.py - app factory and middleware (CORS, logging)oauth2.py - JWT / token helpersrate_limiter.py - request rate limiting helpersrouters/ - grouped routers: auth.py, user.py, api_keys.pycore/ - core infra and settings
config.py - application settings (loaded from .env)database.py - SQLAlchemy engine, SessionLocal, Basemodels.py - SQLAlchemy models (domain entities)redis_client.py - Redis connection helperalembic/ - database migrationsrequirements.txt - pinned dependenciesThe starter exposes a few routers already wired into api/main.py:
GET / - root; a small welcome payloadauth routes - login, token endpoints (see api/routers/auth.py)user routes - user management (see api/routers/user.py)api_keys routes - API key creation/management (see api/routers/api_keys.py)Explore the code in api/routers to see exact paths and payloads. The OpenAPI docs at /docs will show the current endpoints.
This starter supports two authentication methods side-by-side: JWT Bearer tokens and API keys. The authentication dependency (get_current_user) will try a Bearer token first, then fall back to an API key if present.
Key points:
Header name: X-API-Key — include your API key in this header when calling protected endpoints.
API keys are returned only once when created (the raw key). The service stores a hashed version in the database and caches key metadata in Redis.
Create an API key (requires an authenticated user using a JWT):
/api-keys/ with an optional JSON body { "days": 30 } to set the number of days the key will be valid (defaults to 30).{ "api_key": "tf_<secret>", "expires_at": "<iso-datetime>" } — store the api_key securely; it will not be shown again.List your API keys (safe metadata only):
/api-keys/ — returns non-secret metadata (id, created_at, expires_at, is_active).Revoke an API key:
/api-keys/{key_id} — removes the key from the DB and cache. Requires the owning user's authentication.Example: call a protected endpoint using an API key
# Use X-API-Key header (no Bearer token required when using a valid API key)
curl -H "X-API-Key: tf_your_generated_key_here" http://127.0.0.1:8000/some/protected/endpoint
curl -X POST http://127.0.0.1:8000/api-keys/ \
-H "Authorization: Bearer <your_jwt_token>" \
-H "Content-Type: application/json" \
-d '{"days":30}'
Security and behavior notes:
.env settings (MAX_FAILED_ATTEMPTS, LOCKOUT_DURATION_SECONDS).user_rate_limiter dependency; tune USER_RATE_LIMIT_PER_HOUR in .env.Logging is configured in api/main.py with a rotating file handler writing to logs/app.log by default. The app also logs to stdout so containerized setups will capture logs.
This repository is intended to be used as a starter template:
.env with your secrets and DB connectioncore/models.py and create migrationsapi/routers and add testsDATABASE_URL is valid and reachable.REDIS_HOST/REDIS_PORT match.This project is provided under the terms in LICENSE.md (MIT License).
Reprompts /
FastSecForge - A pluggable FastAPI security boilerplate generator with JWT auth, MongoDB/SQLAlchemy support, and a CLI for instant project scaffolding. Boost your backend development with built-in best practices!
31/100 healthkazi-naimul /
FastAPI boilerplate for industry level application
32/100 healthkrishnakamalbaishnab /
A FastAPI starter template with JWT auth, MongoDB, and LLM integration
57/100 healthmarcieltorres /
it's a simple and useful boilerplate for python projects using fast api framework
61/100 health