Setup a Simple API Using Python and Flask

In this article — a continuation of Part 1 — I’ll cover some more advanced topics I previously mentioned. To begin, we’ll implement a simple login/register system where clients can register, log in using their credentials, and check their profile. So, let’s get started!

Flask Global Variables#

Flask provides several global variables that can simplify your development workflow. For example, the request object is a global variable that stores data related to HTTP requests — such as URL, query parameters, headers, and more.

You can import Flask global variables in two ways:

1
from flask import globals  # imports all global vars

Or, if you only need specific ones (recommended for cleaner code):

1
from flask import request

To see how we can access incoming data, let’s create a simple /test route:

1
@app.route('/test', methods=['GET'])
2
def test():
3
    name = request.args.get('name')
4
    username = request.args.get('username')
5
    password = request.args.get('password')
6
    return f"Hello, {name}! Your username is {username} and your password is {password}"

This route accepts only GET requests. You can access the parameters sent by the client via request.args.get('field_name').

For example, accessing this URL:

1
http://localhost:5000/test?name=Armin&username=mynameisarmin&password=mysafepassword

Will return:

1
Hello, Armin! Your username is mynameisarmin and your password is mysafepassword

Ways to Access Request Data#

request.data: raw data as a string when Flask can’t handle the mimetype.
request.args: key/value pairs in the query string.
request.form: key/value pairs in the request body (e.g. from HTML forms).
request.files: uploaded files.
request.values: combines args and form, preferring args if duplicate keys exist.
request.json: parsed JSON data (must have Content-Type: application/json).

These objects are typically instances of MultiDict, except for request.json.

You can access values with:

request.form['name']: use this if you’re sure the key exists.
request.form.get('name'): safer if the key might not exist.
request.form.getlist('name'): use this if the same key is submitted multiple times.

TinyDB#

To build the login/register system, we need a way to store user credentials. Rather than using a full-fledged database like MongoDB or Redis for this small demo, we’ll use TinyDB, a lightweight, document-oriented database that stores data in a JSON file.

“TinyDB is a document-oriented database that stores data in a JSON file. It’s the closest thing I’ve found to a NoSQL version of SQLite. It’s simple, lightweight, serverless, and extensible.” — lyz-code.github.io

To install TinyDB:

1
pip install tinydb

We’ll also write a helper class to simplify using TinyDB. Create a file called db.py with the following content:

1
from tinydb import TinyDB, Query
2
import os
3

4
class Database:
5
    def __init__(self, dbName, dbPath):
6
        self.dbName = dbName
7
        self.dbPath = dbPath if dbPath.endswith('/') else dbPath + '/'
8
        self._initialize_db_path()
9
        self.db = TinyDB(self.dbPath + self.dbName, indent=4, sort_keys=True, separators=(',', ':'))
10

11
    def _initialize_db_path(self):
12
        if not os.path.exists(self.dbPath):
13
            os.makedirs(self.dbPath)
14

15
    def query(self, table, query):
16
        return self.db.table(table).search(query)
17

18
    def insert_or_update(self, table, data):
19
        table_ref = self.db.table(table)
20
        table_ref.upsert(data, Query().id == data['id'])
21
        return True
22

23
    def insert(self, table, data):
24
        self.db.table(table).insert(data)
25
        return True
26

27
    def close(self):
28
        self.db.close()

Then import your helper and Flask’s jsonify in your main file:

1
from db import *
2
from flask import jsonify

Create the database instance after initializing your Flask app:

1
app = Flask(__name__)
2
myDatabase = Database('db.json', 'database/')

Register Route#

1
@app.route('/register', methods=['POST'])
2
def register():
3
    name = request.json['name']
4
    username = request.json['username']
5
    password = request.json['password']
6

7
    if myDatabase.query('users', Query().username == username):
8
        return jsonify({"error": "Account already exists"})
9

10
    myDatabase.insert('users', {'name': name, 'username': username, 'password': password})
11
    return jsonify({'status': 'success'})

This route accepts JSON data, checks if a user with the same username already exists, and if not, inserts the user into the database.

Testing the Endpoint#

For GET requests: just open the URL in your browser.
For POST requests: use Postman, curl, or online tools like ReqBin.

Tip: Postman is more powerful and user-friendly, but ReqBin is great if you don’t want to install anything.

1
@app.route('/login', methods=['POST'])
2
def login():
3
    username = request.json['username']
4
    password = request.json['password']
5

6
    user = myDatabase.query('users', Query().username == username and Query().password == password)
7
    if user:
8
        return jsonify({'status': 'success'})
9
    return jsonify({'error': 'Account does not exist'})

JWT Integration#

JWT (JSON Web Token) is a secure way to transfer identity and authorization information.

Install the extension:

1
pip install Flask-JWT-Extended

Import what we need:

1
from flask_jwt_extended import create_access_token, get_jwt_identity, jwt_required, JWTManager, verify_jwt_in_request

Configure your app:

1
app.config["JWT_SECRET_KEY"] = "super-secret"  # Replace with a secure key!
2
jwt = JWTManager(app)

You can generate a random key using: https://random.justyy.workers.dev/api/random/?cached&n=32

1
@app.route('/login', methods=['POST'])
2
def login():
3
    username = request.json['username']
4
    password = request.json['password']
5

6
    user = myDatabase.query('users', Query().username == username and Query().password == password)
7
    if user:
8
        return jsonify({
9
            'status': 'success',
10
            'token': create_access_token(identity=username)
11
        })
12
    return jsonify({'error': 'Account does not exist'})

On success, you’ll receive a JWT in the response.

Index Route (JWT Protected)#

1
@jwt_required()
2
@app.route('/index', methods=['GET'])
3
def index():
4
    verify_jwt_in_request()
5
    current_user = get_jwt_identity()
6

7
    if current_user:
8
        return jsonify({'status': 'success', 'username': current_user})
9
    return jsonify({'error': 'Invalid token'})

Send the JWT token in the Authorization header like: Authorization: Bearer <your-token>

Full Source Code#

1
from flask import Flask, request, jsonify
2
from db import *
3
from flask_jwt_extended import create_access_token, get_jwt_identity, jwt_required, JWTManager, verify_jwt_in_request
4

5
app = Flask(__name__)
6
app.config["JWT_SECRET_KEY"] = "super-secret"  # Replace this!
7
jwt = JWTManager(app)
8
myDatabase = Database('db.json', 'database/')
9

10
@app.route('/', methods=['GET'])
11
def home_page():
12
    return "Tada! My simple Flask app is running!"
13

14
@app.route('/register', methods=['POST'])
15
def register():
16
    name = request.json['name']
17
    username = request.json['username']
18
    password = request.json['password']
19
    if myDatabase.query('users', Query().username == username):
20
        return jsonify({"error": "Account already exists"})
21
    myDatabase.insert('users', {'name': name, 'username': username, 'password': password})
22
    return jsonify({'status': 'success'})
23

24
@app.route('/login', methods=['POST'])
25
def login():
26
    username = request.json['username']
27
    password = request.json['password']
28
    user = myDatabase.query('users', Query().username == username and Query().password == password)
29
    if user:
30
        return jsonify({
31
            'status': 'success',
32
            'token': create_access_token(identity=username)
33
        })
34
    return jsonify({'error': 'Account does not exist'})
35

36
@jwt_required()
37
@app.route('/index', methods=['GET'])
38
def index():
39
    verify_jwt_in_request()
40
    current_user = get_jwt_identity()
41
    if current_user:
42
        return jsonify({'status': 'success', 'username': current_user})
43
    return jsonify({'error': 'Invalid token'})
44

45
app.run(host='localhost', port=5000)

Conclusion#

In this final article, I’ve introduced more advanced concepts like authentication and token-based authorization using JWTs. I hope it was helpful! If you have any questions or comments, feel free to leave them below — I’ll respond as soon as I can.