FastAPI Production API v1.2.0 - Authentication Lifecycle

Highlights

v1.2.0 adds a complete, backward-compatible authentication lifecycle to the
production FastAPI foundation.

Email identity and account recovery

• Optional normalized email identity during registration
• Scoped, expiring, single-use verification and password-reset tokens
• Hash-only lifecycle-token storage and enumeration-resistant request responses
• Atomic password reset with refresh-session revocation

Sessions and devices

• Refresh-token families with rotation-replay detection
• Bounded device labels and authenticated session listing
• Idempotent per-device and all-session revocation

TOTP multi-factor authentication

• Encrypted TOTP seeds and replay-resistant counter tracking
• Opaque second-factor login challenges
• Hash-only, single-use recovery codes
• Authentication-method and authentication-time claims for step-up checks

TOTP helps reduce password-only risk but is not phishing resistant. Applications
with that requirement should prefer WebAuthn/passkeys in a future integration.

OpenID Connect

• Provider-neutral Authorization Code flow with PKCE S256
• Browser-bound, hash-only state and nonce transactions
• Strict issuer, audience, authorized-party, signature, and nonce validation
• Immutable issuer/subject identities and explicit recent-auth account linking
• No automatic linking of an existing local account by matching email

OIDC deployments still require provider registration, exact redirect URI
configuration, secure credentials, and application-specific threat-model review.

Upgrade notes

1. Back up the database and configuration.
2. Review the new email, MFA encryption, and OIDC environment settings.
3. Install v1.2.0 dependencies using the committed lock file.
4. Run alembic upgrade head to apply the authentication lifecycle migrations.
5. Validate email delivery, session revocation, MFA, and OIDC behavior in a
   staging environment before production rollout.

The release remains backward compatible for existing local username/password
accounts. New lifecycle capabilities are opt-in through configuration and API use.

Verification

Release artifacts include the source distribution, wheel, and SHA256SUMS.txt.
The final release commit is required to pass linting, formatting, migrations,
the full test and coverage gate, dependency audit, package build, and isolated
wheel smoke test.

Full changelog: v1.1.0...v1.2.0

FastAPI Production API v1.1.0 - Production Operations and Developer Experience

FastAPI Production API v1.1.0 — Production Operations and Developer Experience

v1.1.0 completes the first focused reliability and operability milestone. It
adds production observability foundations, strengthens failure-path testing,
reduces contributor setup friction, and documents the architecture and full API
lifecycle.

Highlights

Production observability

• Dedicated /health/live and database-backed /health/ready probes
• Prometheus request count, status, latency, and in-progress metrics
• Structured JSON request logs with validated correlation IDs
• Monitoring, alerting, multi-worker metrics, and troubleshooting guidance

Reliability and security confidence

• 79 automated tests with 95.49% combined statement-and-branch coverage
• A 90% coverage regression gate in CI
• Expanded admin, CORS, error-boundary, rate-limit, refresh-token, and rollback
  coverage
• PostgreSQL 17 migrations and tests, dependency audit, package build, and wheel
  smoke test enforced by CI

Developer experience and documentation

• Cross-platform setup, database, migration, server, and quality-gate commands
• Safe .env generation without overwriting existing local configuration
• Docker engine preflight with actionable diagnostics
• Copy-paste curl and PowerShell API examples
• Architecture, deployment, local development, monitoring, and troubleshooting
  guides
• Automated checks for internal documentation links and documented routes

Upgrade from v1.0.1

git fetch --tags
git checkout v1.1.0
uv sync --locked --all-groups
uv run alembic upgrade head
python scripts/dev.py check

No new database migration is introduced by v1.1.0, but running Alembic remains
the supported release procedure. Review MONITORING.md before exposing metrics
or deploying multiple workers.

Compatibility

• Existing authentication and authorization request contracts remain
  compatible.
• Legacy health endpoints remain available but the dedicated liveness and
  readiness endpoints are preferred.
• /metrics is intentionally omitted from OpenAPI and should be restricted to
  trusted monitoring networks.

Known limitations

• Rate limiting remains process local and is not shared across workers or hosts.
• Password reset, email verification, OAuth providers, and MFA are not included.
• The repository does not yet ship a production container image or Kubernetes
  manifest.
• OpenTelemetry tracing remains planned work and is not claimed by this release.

Full changes: v1.0.1...v1.1.0

FastAPI Production API v1.0.1

FastAPI Production API v1.0.1

This patch release aligns the runtime, packaging, documentation, and CI around
one verified production-ready foundation.

Highlights

• Ships a complete wheel containing both app and the package entrypoint.
• Adds PostgreSQL 17 migrations and tests, Ruff lint/format checks, dependency
  auditing, package builds, and wheel smoke testing to CI.
• Strengthens production configuration validation, authentication helpers,
  security headers, rate limiting, and runtime behavior.
• Replaces the deprecated Uvicorn Gunicorn worker and unmaintained Passlib
  bcrypt adapter while retaining compatibility with existing bcrypt hashes.
• Reworks the README, deployment guidance, community files, changelog, roadmap,
  and release process.

Upgrade notes

• Python 3.13 or newer is required.
• Install the locked dependencies with uv sync --locked.
• Apply database migrations with uv run alembic upgrade head.
• Deployments that reference uvicorn.workers.UvicornWorker should use
  uvicorn_worker.UvicornWorker.
• Production deployments must provide a non-placeholder SECRET_KEY containing
  at least 32 bytes and keep DEBUG=false.

Validation

• Ruff lint and formatting checks passed.
• PostgreSQL 17 migrations passed.
• 39 automated tests passed.
• Dependency audit reported no known vulnerabilities.
• Wheel and source distribution built successfully.
• Wheel import and HTTP root/health smoke tests passed.

CI evidence: https://github.com/HoungDev/fastapi-production-api/actions/runs/31262324636

Known limitations

• Rate limiting is stored in process memory and is not shared across workers or
  hosts; use Redis or an API gateway for distributed enforcement.
• Password reset, email verification, OAuth providers, and MFA are not included.
• Docker Compose provides PostgreSQL for local development but does not build or
  deploy the API container.
• Deployment defaults must be reviewed for traffic, proxy topology, secrets,
  backups, and compliance requirements.

Artifacts

• fastapi_production_api-1.0.1-py3-none-any.whl
  • SHA-256: 56d9e2b276a31246e7312bbd44bcc2f923058aabd67ee338bf9e2f77d7ff9908
• fastapi_production_api-1.0.1.tar.gz
  • SHA-256: 436af2fbdd03623c1a3d3c99d5c8827f8943087db7fc9511656ae7eb1c8e0a26

Full changelog: v1.0.0...v1.0.1

FastAPI Production API v1.0.0 - Production Foundation

FastAPI Production API v1.0.0

The first stable production release of FastAPI Production API.

This release establishes a secure, scalable, and production-ready FastAPI backend foundation maintained by HoungDev.

---

🚀 Release Highlights

Backend Architecture

• FastAPI production application structure
• PostgreSQL database integration
• SQLAlchemy ORM
• Alembic database migrations
• Environment-based configuration
• Gunicorn + Uvicorn production server support

---

🔐 Authentication & Security

• JWT authentication
• OAuth2 password authentication
• Access token support
• Refresh token support
• Refresh token rotation
• Refresh token revocation
• Refresh token hashing
• bcrypt password hashing
• JWT issuer validation
• JWT audience validation
• Role-based authorization

---

🛡️ Production Middleware

• CORS configuration
• Security headers middleware
• Rate limiting middleware
• Request logging middleware
• Global exception handling
• Database transaction rollback safety

---

🧪 Testing & Quality

Automated test coverage includes:

• Authentication flows
• JWT validation
• Token security checks
• Protected routes
• Refresh token rotation
• Rate limiting
• User management

Test status:

34 tests passed

---

⚙️ CI/CD

Included:

• GitHub Actions workflow
• Automated dependency installation
• Database migration checks
• Automated testing
• Security audit workflow

---

📚 Documentation

Available documentation:

• README.md
• CONTRIBUTING.md
• CODE_OF_CONDUCT.md
• ROADMAP.md
• DEPLOYMENT.md
• CHANGELOG.md

---

🌱 Open Source

FastAPI Production API is built to help developers learn and build secure production-ready backend systems with FastAPI.

Contributions, suggestions, and discussions are welcome.

---

👤 Maintainer

Maintained by:

HoungDev

Focused on:

• Python backend development
• FastAPI architecture
• API security
• Production engineering

---

Thank you for supporting open-source development ❤️