Skip to main content
FastQL’s core is transport-free: it has no HTTP server, no TLS, and no connection management. Production deployment means wrapping the schema in a framework adapter and running that adapter with a production-grade ASGI server. This page covers the standard patterns.
Never expose python -m fastql serve (the development server) directly to untrusted networks. It provides no TLS, no authentication, no connection reuse, and no production hardening. It is for local exploration only.

Choosing a framework adapter

All adapters implement the same HTTP contract and share the same context-injection API.

Basic ASGI deployment (FastAPI + Uvicorn)

For higher concurrency use Gunicorn with the Uvicorn worker class:

Subscriptions in production

The development server does not support subscription transports. To serve WebSocket subscriptions in production:
  1. Use an ASGI adapter that exposes WebSocket (fastql.asgi, fastql.starlette, fastql.fastapi, fastql.aiohttp, etc.).
  2. Run an ASGI server that supports WebSocket — Uvicorn and Hypercorn both do.
  3. Configure your reverse proxy (nginx, Caddy, AWS ALB) to pass WebSocket upgrade requests through to the ASGI process.
SSE (Accept: text/event-stream) and multipart/mixed subscriptions work over plain HTTP and do not need special WebSocket configuration — any HTTP/1.1 or HTTP/2 connection that supports streaming responses will work.

Environment variables and configuration

FastQL itself reads no environment variables. Configure your schema, context, and adapter in Python code; inject secrets via environment variables at the framework or application level:

Health checks

Expose a lightweight health endpoint alongside GraphQL. With FastAPI:
GraphQL introspection can also serve as a readiness probe (a successful { __typename } query means the schema is loaded and the execution engine is ready).

Containerizing with Docker

Expose port 8000 and mount secrets via environment variables or a secrets manager rather than baking them into the image.

What FastQL does not provide

  • TLS termination — handle at the reverse proxy or load balancer.
  • Session management or cookie auth — use your framework’s middleware.
  • Rate limiting — use a reverse proxy or API gateway layer.
  • Schema stitching / persisted operations — outside the current capability set.
See Authentication for integrating auth into the request pipeline.