The FastAPI Production Checklist

FastAPI makes it dangerously easy to ship. A tutorial app and a production service look almost identical — until traffic, bad input, and a flaky network find every corner you skipped. This checklist covers the gap, in the order things usually break.

1. Validate at the boundary, trust nothing

Pydantic models are your contract with the outside world. Constrain every field: lengths on strings, ranges on numbers, enums for anything with a fixed vocabulary. An unconstrained str field is an invitation for a megabyte of junk to reach your database.

from pydantic import BaseModel, EmailStr, Field

class CreateBookmark(BaseModel):
    url: str = Field(max_length=2048, pattern=r"^https?://")
    title: str = Field(min_length=1, max_length=200)
    tags: list[str] = Field(default_factory=list, max_length=10)
    notify_email: EmailStr | None = None

2. Size the connection pool deliberately

The default SQLAlchemy pool is five connections. Under load, requests queue behind the pool and your fast endpoints turn slow with no error to explain why. Set pool size from arithmetic — workers times concurrent requests per worker — and always set a pool timeout so saturation fails loudly instead of hanging.

engine = create_async_engine(
    settings.database_url,
    pool_size=10,
    max_overflow=5,
    pool_timeout=5,      # fail fast instead of queueing forever
    pool_pre_ping=True,  # survive database restarts
)

3. Put a timeout on every outbound call

Every HTTP client call, every LLM API request, every Redis command needs an explicit timeout. The default for most clients is no timeout at all, which means one slow dependency can hold your worker hostage and cascade into a full outage.

The rest of the checklist

• Run behind a process manager with multiple workers, not a bare uvicorn process.
• Add structured logging with a request ID middleware so you can trace a failure across services.
• Rate limit by user or IP at the edge; do not let one client consume your capacity.
• Hash passwords with argon2 or bcrypt — never build your own token or session scheme.
• Return uniform error shapes; never leak stack traces or SQL in responses.
• Pin dependencies and run migrations as a deploy step, not at import time.
• Health-check endpoint that verifies the database, not just the process.
• Load test the two endpoints you believe are fine. One of them is not.

The Bookmark Manager API project implements all twelve items with tests, if you want to study a working reference instead of a list.