Alcazaba

Secure, maintained tools for FastAPI
Response cache, rate limits, sessions, CSRF, webhooks, a task queue and more, in one package.

Documentation | Examples | PyPI | Changelog | Security policy

Alcazaba (fastapi-alcazaba) gathers the pieces most FastAPI apps end up writing themselves, built with security in mind and tested against real servers. They share one backend (memory, Redis, Valkey, memcached or DynamoDB), one format of errors and one set of metrics.

Install

pip install fastapi-alcazaba            # in-memory backend only
pip install "fastapi-alcazaba[redis]"   # or [valkey], [glide], [memcache], [dynamodb], [all]

Python 3.11+, FastAPI 0.115+ and Pydantic v2. The other extras (OpenTelemetry, encryption, Casbin, JWT, OAuth2, SAML...) are in the guide.

A taste

from collections.abc import AsyncIterator
from contextlib import asynccontextmanager

from fastapi import Depends, FastAPI
from pydantic import BaseModel

from fastapi_alcazaba import FastAPICache
from fastapi_alcazaba.backends.inmemory import InMemoryBackend
from fastapi_alcazaba.rate_limit import FastAPIRateLimiter
from fastapi_alcazaba.response_cache import cache


@asynccontextmanager
async def lifespan(_: FastAPI) -> AsyncIterator[None]:
    FastAPICache.init(InMemoryBackend(), prefix="shop")  # RedisBackend for several processes
    yield


app = FastAPI(lifespan=lifespan)


class Product(BaseModel):
    name: str
    price: float


@app.get(
    "/products/{product_id}",
    dependencies=[Depends(FastAPIRateLimiter(times=10, seconds=1))],  # per client
)
@cache(expire=60, vary_headers=())  # the same response for everybody: one shared entry
async def product(product_id: int) -> Product:
    return Product(name="Olive oil", price=9.5)

The guide starts with an app built in three steps, and each tool has a page of its own and an example app that runs as it is.

Security

The security tools (revocations, idempotency, webhooks, sessions, the task queue) fail closed when the backend does, and none of them puts secrets in logs, keys or errors. The security model says what each tool protects against and what it needs from you; report vulnerabilities as SECURITY.md says.

Development

make deps               # .venv with every extra
make lint               # ruff, mypy and pylint
make test               # the unit tests, with coverage
make services-up        # Redis, Valkey, memcached and DynamoDB in Docker, for:
make test-integration

CONTRIBUTING.md has the rest.

License

Apache License 2.0: see LICENSE and NOTICE.