Python’s Third-Party Ecosystem for Web Development

Python’s third-party ecosystem — packages available on PyPI and installed with pip — is one of its greatest strengths. For FastAPI web development, a small set of well-maintained packages handles nearly every concern: validation, database access, migrations, authentication, email, file storage, and testing. Knowing which package to reach for — and crucially, which packages are standard choices in the FastAPI community vs alternatives — lets you build on proven foundations rather than reinventing wheels. This lesson surveys the core packages you will use throughout the rest of this series.

The Core FastAPI Ecosystem #

pydantic-settings — Configuration Management #

from pydantic_settings import BaseSettings
from pydantic import AnyHttpUrl
from typing import List

class Settings(BaseSettings):
    # Database
    database_url: str = "postgresql://localhost/blogdb"

    # Auth
    secret_key: str = "changeme-in-production"
    algorithm: str  = "HS256"
    access_token_expire_minutes: int = 30

    # CORS
    allowed_origins: List[AnyHttpUrl] = ["http://localhost:5173"]

    # App
    app_name: str = "Blog API"
    debug: bool   = False

    class Config:
        env_file = ".env"            # load from .env file
        case_sensitive = False       # DATABASE_URL or database_url both work

# Singleton — create once, import everywhere
settings = Settings()

# Usage anywhere:
# from app.config import settings
# print(settings.database_url)

Quick Overview of Key Packages #

# ── passlib — password hashing ────────────────────────────────────────────────
from passlib.context import CryptContext

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

def hash_password(plain: str) -> str:
    return pwd_context.hash(plain)

def verify_password(plain: str, hashed: str) -> bool:
    return pwd_context.verify(plain, hashed)

# ── python-jose — JWT tokens ──────────────────────────────────────────────────
from jose import jwt, JWTError
from datetime import datetime, timedelta, timezone

SECRET_KEY = "your-256-bit-secret"
ALGORITHM  = "HS256"

def create_access_token(data: dict, expires_minutes: int = 30) -> str:
    payload = {
        **data,
        "exp": datetime.now(timezone.utc) + timedelta(minutes=expires_minutes)
    }
    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)

def decode_token(token: str) -> dict:
    return jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])

# ── httpx — async HTTP client ─────────────────────────────────────────────────
import httpx

async def fetch_external_api(url: str) -> dict:
    async with httpx.AsyncClient() as client:
        response = await client.get(url, timeout=10.0)
        response.raise_for_status()    # raises on 4xx/5xx
        return response.json()

# httpx also provides a sync test client for FastAPI tests:
# from httpx import TestClient (used in pytest fixtures)

Development Tools #

# Format code with black
black app/ tests/

# Lint with ruff (fast)
ruff check app/
ruff check --fix app/    # auto-fix fixable issues

# Type check with mypy
mypy app/

# Run tests with pytest
pytest tests/ -v
pytest tests/ -v --cov=app   # with coverage report

Common Mistakes #

Mistake 1 — Using Pydantic v1 syntax with v2 installed #

❌ Wrong — v1 validator syntax in v2:

from pydantic import validator   # ImportError in Pydantic v2!

✅ Correct — v2 syntax:

from pydantic import field_validator   # ✓ Pydantic v2

Mistake 2 — Using SQLAlchemy 1.x query syntax with 2.0 installed #

❌ Wrong — legacy query API (deprecated in 2.0):

db.query(Post).filter(Post.id == 1).first()   # legacy — still works but deprecated

✅ Correct — SQLAlchemy 2.0 style:

from sqlalchemy import select
db.execute(select(Post).where(Post.id == 1)).scalar_one_or_none()   # ✓ 2.0

Mistake 3 — Hardcoding secrets in code instead of using pydantic-settings #

❌ Wrong — secret in source code:

SECRET_KEY = "super-secret-do-not-commit"   # committed to git!

✅ Correct — read from environment:

class Settings(BaseSettings):
    secret_key: str   # required — must be in .env or environment ✓

Quick Reference — Install Command #

# Install the complete FastAPI + PostgreSQL stack
pip install fastapi uvicorn[standard] sqlalchemy alembic \
    psycopg2-binary pydantic-settings \
    "python-jose[cryptography]" "passlib[bcrypt]" \
    python-multipart httpx python-dotenv

# Install dev tools
pip install pytest pytest-asyncio black ruff mypy