A production-oriented backend system built with FastAPI, demonstrating secure authentication, Redis-based security controls, rate limiting, and scalable API architecture.
This project focuses primarily on backend engineering, while the React frontend acts as a client interface used to interact with backend APIs.
The goal of this project is to demonstrate skills relevant for Backend / Python Developer roles, including authentication systems, Redis-based security mechanisms, modular backend architecture, and API development.
[https://fastapi-jwt-redis-backend.vercel.app]
[https://fastapi-jwt-redis-backend.onrender.com]
[https://fastapi-jwt-redis-backend.onrender.com/docs]
Users can browse products and add items to their cart.
Interactive API documentation generated by FastAPI.
graph TD
User --> ReactFrontend
ReactFrontend --> FastAPIBackend
FastAPIBackend --> PostgreSQL
FastAPIBackend --> Redis
ReactFrontend[React Frontend - Vercel]
FastAPIBackend[FastAPI Backend - Render]
PostgreSQL[PostgreSQL Database - Neon]
Redis[Redis Security Layer - Upstash]
This project demonstrates real-world backend engineering patterns:
• Secure authentication system • Redis security layers • Rate limiting implementation • Structured logging • Modular API architecture • Token lifecycle management • Background task scheduling • Role-based access control
The application uses a JWT-based authentication system.
• Access Token authentication • Refresh Token rotation • Refresh token reuse detection • HTTPOnly refresh token cookies • Secure logout using Redis blacklist • Secure logout using refresh token revokation • Password hashing using bcrypt
sequenceDiagram
User->>Frontend: Login Request
Frontend->>Backend: /auth/login
Backend->>Database: Verify credentials
Backend->>Frontend: Access Token + Refresh Token
Frontend->>Backend: API Request (Authorization Header)
Backend->>Frontend: Response
Frontend->>Backend: /auth/refresh
Backend->>Frontend: New Access Token
Role-Based Access Control is implemented.
Roles:
Admin
User
Admin permissions:
• Create products • Update products • Delete products
User permissions:
• View products • Add products to cart • Manage cart items
Authorization is enforced through FastAPI dependencies.
Redis is used to implement backend security features.
Redis enables:
• Login rate limiting • Refresh token rate limiting • Token blacklist for logout • Fast token validation • Automatic expiration using TTL
Example Redis keys:
login:ip:<ip>
login:email:<email>
refresh:ip:<ip>
refresh:user_id:<id>
blacklist:<access_token>
Login and Refresh tokens attempts are limited to prevent brute-force attacks per Email or Username and IP address.
Example configuration:
Maximum attempts: 5
Window: 60 seconds
Exceeded attempts return:
HTTP 429 Too Many Requests
Redis automatically resets counters using TTL.
Security events are logged using structured logs.
Example logs:
event=login_attempt ip=103.x.x.x email=user@email.com
event=login_rate_limit_exceeded ip=103.x.x.x
event=login_success user_id=3
This demonstrates observability practices used in production systems.
Each user maintains an isolated cart.
Features:
• Add products to cart • Update cart quantity • Remove cart items • User-specific cart isolation
Example endpoints:
POST /cart/add
PATCH /cart/update/{product_id}
DELETE /cart/remove/{product_id}
Admin-controlled inventory system.
Endpoints:
GET /products
POST /products
PATCH /products/{id}
DELETE /products/{id}
Users can browse products and add them to their cart.
Background tasks are implemented using APScheduler.
Tasks include:
Cleanup of expired tokens
Maintenance of revoked tokens
This demonstrates backend background job scheduling.
FastAPI Python PostgreSQL SQLAlchemy ORM Redis APScheduler python-jose (JWT) passlib / bcrypt
React Vite Axios
The frontend is intentionally lightweight because the primary focus of this project is backend architecture.
Database: Neon PostgreSQL Redis: Upstash Backend Deployment: Render Frontend Deployment: Vercel
fastapi-jwt-redis-backend
│
├── app
│ ├── core
│ │ ├── auth.py
│ │ ├── security.py
│ │ ├── redis_client.py
│ │ └── rate_limiter.py
│ │
│ ├── db
│ │ ├── database.py
│ │ └── database_models.py
│ │
│ ├── routers
│ │ ├── auth_router.py
│ │ ├── product_router.py
│ │ └── cart_router.py
│ │
│ ├── services
│ │ ├── cart_service.py
│ │ └── product_service.py
│ │
│ ├── tasks
│ │ └── token_cleanup.py
│ │
│ └── main.py
│
├── frontend
│ ├── src
│ ├── pages
│ ├── components
│ └── api
│
├── screenshots
│
├── requirements.txt
└── README.md
git clone https://github.com/AkashAkuthota/fastapi-jwt-redis-backend.git
cd fastapi-jwt-redis-backend
python -m venv myenv
source myenv/bin/activate
pip install -r requirements.txt
Create .env
SECRET_KEY=your_secret_key
DATABASE_URL=your_postgres_connection
REDIS_HOST=your_upstash_host
REDIS_PORT=6379
REDIS_PASSWORD=your_upstash_password
ACCESS_TOKEN_EXPIRE_MINUTES=30
REFRESH_TOKEN_EXPIRE_DAYS=7
uvicorn app.main:app --reload
API docs:
http://localhost:8000/docs
cd frontend
npm install
npm run dev
This project demonstrates backend engineering practices such as:
• Secure authentication systems • Redis-based security controls • Rate limiting implementation • Scalable API design • Modular backend architecture • Token lifecycle management • Background job scheduling • Observability through structured logging
The project is designed to showcase capabilities relevant for Backend / Python Developer roles, while also demonstrating the ability to integrate backend APIs with a frontend client.
Akash Akuthota
GitHub [https://github.com/AkashAkuthota]
LinkedIn [https://www.linkedin.com/in/akashakuthota/]
Consider giving the repository a star ⭐ on GitHub.