Production checklist
FastAPI production checklist: 6 checks before launch
6 checks for running FastAPI in production: 3 should-dos and 3 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (3)
Restrict CORS to your own origins
allow_origins=["*"] with credentials lets any site call your API as your users.
Verify with a request
Send a preflight from an origin you don’t trust. A pass: no Access-Control-Allow-Origin for that origin, and never * together with credentials.
curl -sI -X OPTIONS https://<your-api>/<route> -H "Origin: https://evil.example" -H "Access-Control-Request-Method: GET" | grep -i access-control
Declare request bodies and parameters with Pydantic models
FastAPI then rejects malformed input with a 422 before your code runs.
Verify from the command line
Endpoints take Pydantic models, not the raw request. This search should only find code that validates what it reads.
grep -rn "request.json()" --include=*.py .
Protect private endpoints with a security dependency
An endpoint without one is public, whatever the frontend shows.
Verify with a request
Call a private endpoint without a token; it should return 401 or 403.
curl -s -o /dev/null -w "%{http_code}\n" https://<your-api>/<private-route>
Good to have (3)
Turn off or protect
/docsand/openapi.jsonin productionThe generated docs list every endpoint and parameter of a private API.
Verify with a request
In production the schema should return 404 (or need a login).
curl -s -o /dev/null -w "%{http_code}\n" https://<your-api>/openapi.jsonRun with several workers, not the dev server
fastapi devreloads on file changes and runs one process; production needsfastapi runwith workers.Verify from the command line
The production start command uses fastapi run (or uvicorn) with workers, never fastapi dev or --reload.
fastapi run --workers 4 app/main.py
Trust forwarded headers only from your own proxy
Otherwise a client can fake its IP address and scheme with X-Forwarded-* headers.
Verify from the command line
The server only trusts X-Forwarded-* headers from your proxy’s addresses (use * only when nothing but the proxy can reach the app).
uvicorn app.main:app --proxy-headers --forwarded-allow-ips="<proxy ip>"
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.