How to use the FastAPI Patterns agent skill (fastapi-patterns)

What does the fastapi-patterns skill make the agent do?

Once installed, the skill gives the agent a specific way of structuring FastAPI code. It suggests separating routes, Pydantic request and response schemas, dependency injection, and database logic into different files, and it provides copy-ready examples for async endpoints, authentication dependencies, error handling and OpenAPI docs.

The skill also tells the agent to flag common production risks. The source's examples include leaking password hashes in responses and combining wildcard CORS origins with credentials.

• Thin route layer over explicit dependencies and service code
• Separate Pydantic models for create, update and response data
• Tests that override dependencies instead of opening production resources
• Guidance on security basics such as password hashing and JWT validation

How do you install the fastapi-patterns skill?

Download the skill ZIP from this page and unzip it. The skill is a single file, SKILL.md. Place the unzipped skill folder in one of two locations: your user skills folder at ~/.claude/skills/ so it is available in every project, or a project's .claude/skills/ folder so it applies only to that project.

You can also upload the skill in the Claude apps. Go to Settings, then Capabilities, then Skills, and add the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

How do you trigger the skill with natural requests?

You do not need a special command. Describe the FastAPI task in plain language and mention FastAPI, so the agent knows which conventions apply. The skill's own description covers async APIs, dependency injection, Pydantic models, OpenAPI docs, tests, security and production readiness, so requests about those topics are the ones it is meant to handle.

Requests that work well name the job and the context, for example that you are building a new service, reviewing a pull request, or adding authentication to an existing app.

• Build a new FastAPI service with users, auth and a health check.
• Review this FastAPI pull request for security and structure problems.
• Split this main.py into routers, schemas and dependencies.
• Add pagination to my list endpoint and make sure the response model hides internal fields.
• Write pytest tests for this route that override the database dependency.

What does the recommended project layout look like?

The skill proposes a layout where main.py handles app construction, middleware, exception handlers and router registration. Schemas, dependencies, services and tests each have their own place. The layout below is the one given in the source; you can adapt it to your project.

• main.py: app construction, middleware, exception handlers, routers
• schemas/: Pydantic request and response models
• dependencies.py: database, auth and pagination dependencies
• services/ or crud/: business and persistence operations
• tests/: dependency overrides

What are the main safety rules the skill enforces?

The skill's guidance keeps raw ORM objects, secrets and framework globals out of response schemas. Response models must never include password hashes, access tokens, refresh tokens or internal authorization state. For CORS, do not use allow_origins=["*"] together with allow_credentials=True, because browsers reject that combination.

For authentication, the checklist asks you to hash passwords with argon2-cffi, bcrypt, or a current passlib-compatible hasher, and to validate JWT issuer, audience, expiry and signing algorithm. Check each suggestion against current library documentation before you ship it.

• Never return password hashes or tokens in response models
• Never combine wildcard CORS origins with credentials
• Validate JWT issuer, audience, expiry and signing algorithm
• Avoid creating sessions or clients inline inside route handlers

What does the skill need and what does it not do?

The skill needs Python and FastAPI. The examples also assume Pydantic, SQLAlchemy async and httpx. The skill does not run scripts and does not use the network. It provides patterns and snippets, not a finished, deployable project, so you still need to write configuration, models, and the rest of the application.

Treat the output as a starting point for review. Verify the code against the versions of the libraries you actually use.

• Requires: Python, FastAPI; examples assume Pydantic, SQLAlchemy async, httpx
• Runs scripts: no
• Uses network: no
• Licence: MIT