FastAPI REST API development
One typed API behind every client you will ever ship.
Acasa Labs builds REST APIs in FastAPI: Pydantic models at the edge, an OpenAPI schema your frontends generate clients from, and tests around permissions and tenants. Pullsy's FastAPI backend serves its web app, a native iOS app, and a public REST API with keys. For APIs in any stack, see our API development page.
The problem
FastAPI makes endpoints easy. APIs are still hard.
A FastAPI endpoint takes ten lines, which is why FastAPI codebases often grow into two hundred endpoints with no shared rules. Auth is checked in some routes and not others, response models drift from what the app expects, async routes call blocking libraries, and the mobile app breaks the day a field is renamed. FastAPI gives you the tools to prevent every one of those: dependencies, typed models, and a generated schema. They only help if they are used the same way from the first route.
What we build with FastAPI
- 01
Typed contracts
Pydantic request and response models on every route, so the OpenAPI schema is always right and the frontend's generated client matches the server.
- 02
Auth and tenancy as dependencies
The current user, their organization, and their plan resolved once in FastAPI dependencies, so no route can forget to check them.
- 03
Versioned endpoints
Versioned routers and deprecation windows, so an old app version in the store keeps working while the next one ships.
- 04
Public APIs with keys
API keys, scopes, and rate limits per key for your customers' developers, documented from the same schema your own apps use.
From production
From the FastAPI APIs we run.
Three clients, one API
PullsyPullsy's FastAPI and SQLAlchemy backend serves the Next.js web app, a native SwiftUI app on iOS 17 and later, and a public REST API with keys for developers.
Plans enforced below the routes
PullsyAn entitlement service covers per-seat and per-storefront plans, and the limits are enforced down to a database constraint, so a limit holds even if a route forgets to ask.
Tenant isolation, tested
PullsyMulti-tenant isolation in Pullsy is covered by tests, so the rule that one account never sees another's data is checked on every change, not trusted.
Connectors behind one interface
PullsyA pluggable connector registry sits under the API and already reaches beyond Instagram, so a new data source is a new connector rather than a new set of endpoints.
Every surface on the same service
NoteTubeNoteTube's web app and Expo mobile app both call one FastAPI service for AI, so prompts, model choice, and keys are defined once and never shipped inside a client.
Honest trade-offs
When FastAPI is not the right API framework
If most of the API is create, read, update, and delete over many related tables, with an admin and detailed permissions, Django REST Framework gives you more for free. If your team works only in TypeScript and the API is a thin layer over a database, a Node API next to your Next.js app may be easier for them to own. For REST, integrations, and MCP servers in any stack, see our API development page.
What we reach for
- FastAPI, Pydantic v2
- SQLAlchemy 2, Alembic
- OAuth2, JWT, API keys
- OpenAPI client generation
- Postgres, Redis
- pytest, httpx
Proof
Shipped, not pitched.
01Our product
Pullsy
Instagram analytics that keep the numbers Instagram throws away.
Analytics for creators. Pullsy keeps insights Instagram discards after about 90 days, explains what each number means, grades the account, and turns it into a media kit a brand can verify.
Web · iOS (native SwiftUI) · REST API
02Our product
NoteTube
A lecture becomes a study system: chat, flashcards, quizzes, all grounded in the source.
An AI learning platform that turns PDFs, YouTube lectures, recordings, and notes into a structured notebook with grounded chat, spaced-repetition flashcards, and graded quizzes.
Web · iOS · Android · Chrome extension · MCP server
Questions
FastAPI REST APIs questions we get asked.
Why FastAPI for a REST API?
Typed request and response models, an OpenAPI schema generated from the code, async I/O, and dependency injection for auth and database sessions. You get documentation and client generation without writing them by hand.
Sync or async routes?
Async when the route waits on the network or a database through an async driver. Plain sync when it calls a blocking library, so FastAPI runs it in a thread pool instead of stalling the event loop. Mixing them up is a common cause of slow FastAPI apps.
How do you version a FastAPI API?
With a router per version, response models that only add fields within a version, and a deprecation window before an old version is removed. Mobile apps make this matter most, because old versions stay installed.
Can you document our existing FastAPI API?
Yes. We tighten the response models so the generated OpenAPI schema is accurate, then publish documentation and typed clients from it.
How do you test a FastAPI API?
With pytest against a real Postgres, overriding the auth dependencies per test. Permission and tenant tests come first, as in Pullsy, where tests check that tenants stay isolated.
FastAPI REST API development
Your FastAPI API, reviewed.
A free 30-minute review of your FastAPI routes, models, and auth, or of the API you are about to build. You leave with what we would fix first.