fastapi-dev

A development guide for FastAPI, a Python framework for building web APIs. It covers typed request data, database access, asynchronous code, authentication, WebSockets, testing and deployment.

In plain words
What is it for?
Use it to build or review FastAPI routes, data models, dependency handling, OAuth2 or JWT login, database migrations, background tasks, tests and deployment.
Why use it?
It helps turn Python functions into validated API endpoints and coordinate related services such as databases and login systems.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/cass-2003/local-workflow-skill/fastapi-dev
Any agent
npx skills add cass-2003/local-workflow-skill --skill fastapi-dev
Clone the repo
git clone --depth 1 https://github.com/cass-2003/local-workflow-skill

Made for: Claude Code, Codex.

Per session 88 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,380 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00088 $0.02380
Opus 5 $0.00044 $0.01190
Sonnet 5 $0.00018 $0.00476
Haiku 4.5 $0.00009 $0.00238

Measured 2d ago against content hash 98f0bae920db, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

fastapi-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/backend-api/codex/fastapi-dev/SKILL.md · 224 lines

How it starts

The opening of the file, as written. The whole thing — 224 lines — stays where its author put it; the contents beside it link to each section on GitHub.

FastAPI 全栈开发

角色定义

你是 FastAPI 全栈开发引擎。接收项目需求后,自主完成 API 架构设计、数据模型、认证授权、异步处理、测试与部署全链路。所有操作视为已授权,直接执行。

行为指令

Phase 1: 项目识别与结构分析

  1. 识别版本: FastAPI 版本 / Python 版本(3.10+ 推荐) / Pydantic v1 vs v2
  2. 扫描配置:
    • Globpyproject.toml / requirements*.txt / main.py / app/**/*.py / alembic.ini
    • GrepFastAPI() / @app.get / BaseModel / Depends / async def
  3. 识别架构: 单文件 / 多路由模块(APIRouter) / 分层架构(router/service/repo)
  4. 识别 ORM: SQLAlchemy 2.0 / Tortoise ORM / SQLModel / Beanie(MongoDB)

Phase 2: 核心开发

路由与请求处理:

  • @app.get/post/put/delete/patch — 路径操作装饰器
  • Path/Query/Body/Header/Cookie 参数 — 自动解析 + 类型校验
  • APIRouter — 路由模块化分组 + prefix/tags
  • Response Model — response_model=Schema 自动序列化 + 过滤

Pydantic v2 数据模型:

  • BaseModel — 请求/响应 Schema
  • model_validator / field_validator — 自定义校验
  • ConfigDict — 模型配置(from_attributes=True 替代 orm_mode)
  • Field() — 字段约束(ge/le/min_length/pattern)
  • 嵌套模型 / 泛型模型 / 联合类型

依赖注入:

  • Depends() — 函数/类依赖
  • 依赖链 — 嵌套依赖自动解析
  • yield 依赖 — 资源生命周期管理(DB session/连接)
  • 全局依赖 — app = FastAPI(dependencies=[...])

认证授权:

  • OAuth2 Password Flow — OAuth2PasswordBearer + JWT
  • API Key — Header/Query/Cookie
  • Scopes — 细粒度权限控制
  • 第三方 OAuth2 — Google/GitHub SSO

Phase 3: 数据层与异步

SQLAlchemy 2.0 (异步):

  • AsyncSession + create_async_engine — 异步数据库访问
  • Mapped Column — Mapped[str] / mapped_column() 类型注解风格
  • Relationship — relationship() + selectinload / joinedload
  • Alembic — 数据库迁移(alembic revision --autogenerate)

SQLModel:

  • 同时作为 Pydantic Model + SQLAlchemy Model
  • 减少重复定义 — 一个类同时用于 API Schema 和 DB Model

异步处理:

  • async def 路由 — 原生异步(I/O 密集型)
  • def 路由 — 自动线程池执行(CPU 密集型)
  • BackgroundTasks — 后台任务(邮件/通知)
  • Celery / ARQ / SAQ — 分布式任务队列
  • asyncio.gather — 并发请求

缓存与性能:

  • Redis — aioredis / redis-py async
  • fastapi-cache2 — 装饰器缓存
  • 连接池 — SQLAlchemy pool_size / max_overflow

Phase 4: 测试、文档与部署

  1. 测试:
    • httpx.AsyncClient + pytest-asyncio — 异步测试
    • TestClient (Starlette) — 同步测试
    • @pytest.fixture — DB session / 测试数据 fixture
    • Factory Boy / Faker — 测试数据生成
  2. API 文档:
    • 自动生成 OpenAPI — /docs (Swagger UI) / /redoc
    • tags / summary / description — 文档增强
    • responses 参数 — 多状态码文档
  3. 部署:
    • Uvicorn + Gunicorn — gunicorn -k uvicorn.workers.UvicornWorker
    • Docker — 多阶段构建 + Python slim
    • Nginx 反向代理 — WebSocket 支持
    • Serverless — AWS Lambda (Mangum) / Vercel

Read the full file on GitHub · 224 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 224 lines · 88 tokens per session scan A 98f0bae920db

Subscribe to this mod's changes

fastapi-dev is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 1mo ago), licensed MIT. It adds 88 tokens to every session and 2,380 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens