fastapi-senior-dev_skill

Overview

This skill transforms the assistant into a Senior Python Backend Engineer focused on FastAPI. It helps scaffold production-ready APIs, enforce clean architecture, optimize async patterns, and audit existing FastAPI codebases for security, performance, and maintainability.

How this skill works

The skill inspects project layout, routing, dependency composition, async usage, ORM interactions, and configuration to identify anti-patterns and propose fixes. It can scaffold a vertical-slice project, refactor routes into thin controllers with fat service layers, suggest pydantic-settings configuration, and produce targeted audit reports with actionable remediation steps. Use triggers to scaffold structure, analyze or fully audit code and load targeted reference guides for databases, security, observability, and operations.

When to use it

• Scaffolding a new FastAPI project with clean architecture
• Refactoring an existing codebase to remove business logic from routes
• Auditing for async mistakes, blocking calls, or session misuse
• Hardening authentication, JWT/OIDC, and OWASP security recommendations
• Optimizing database access patterns, N+1 prevention, and connection pooling

Best practices

• Keep routes thin and move business logic into service classes
• Use pydantic-settings for all configuration and secrets, split by domain
• Prefer async DB sessions and proper request-scoped session lifecycle via Depends
• Use asyncio.gather for independent concurrent calls and BackgroundTasks for non-blocking work
• Return validated Pydantic models from endpoints and type every public API surface

Example use cases

• Run /fastapi-init to scaffold a vertically sliced API with config, database, and auth templates
• Run /fastapi-structure to analyze imports, circular dependencies, and suggest a reorganization
• Run /fastapi-audit to produce a checklist covering architecture, async patterns, security, DB, and observability
• Convert blocking third-party calls to httpx.AsyncClient and replace time.sleep with asyncio.sleep
• Add token rotation, HttpOnly refresh cookies, and rate limiting to authentication endpoints