Dependency injection — Depends()

Share setup/teardown across routes. get_db is the classic example — opens a DB session per request.

main.py v3.1

from fastapi import FastAPI, Depends, HTTPException
from typing import Optional

app = FastAPI()

# A dependency — a function that yields a value
fake_db = {'users': [{'id': 1, 'name': 'Ada'}]}

def get_db():
    # Setup — runs BEFORE the route
    print('  [db] opening session')
    db = fake_db  # in real life: SessionLocal()
    try:
        yield db
        # The route runs here with db injected
    finally:
        # Cleanup — runs AFTER the route (even on exception)
        print('  [db] closing session')

# Use the dependency
@app.get('/users')
async def list_users(db: dict = Depends(get_db)):
    return db['users']

# Auth dependency — validates a token, returns the user
def get_current_user(token: Optional[str] = None):
    if token != 'secret123':
        raise HTTPException(status_code=401, detail='Invalid token')
    return {'id': 1, 'name': 'Ada'}

@app.get('/me')
async def me(user: dict = Depends(get_current_user)):
    # 'token' is automatically parsed from query params by FastAPI
    return user
# /me?token=secret123 -> 200, returns Ada
# /me?token=wrong     -> 401
# /me                 -> 401

# Dependencies can chain
def get_admin(user: dict = Depends(get_current_user)):
    if user['name'] != 'Ada':
        raise HTTPException(status_code=403, detail='Admin only')
    return user

@app.delete('/users/{user_id}')
async def delete_user(user_id: int, admin: dict = Depends(get_admin)):
    return {'deleted': user_id, 'by': admin['name']}

API simulator click Simulate

Click "Simulate" to see what this FastAPI app does.

🧠 How it works

Depends(fn) — runs fn before the route, injects the yielded value, runs cleanup after. The dependency can itself have dependencies (chain). FastAPI builds a DAG. yield form (gen function) — code before yield is setup, after yield is cleanup. Cleanup runs EVEN on exception — perfect for closing DB sessions, releasing locks. Sub-dependencies: get_admin depends on get_current_user — FastAPI resolves in order. Dependencies can ALSO parse query/cookie/header params (like get_current_user does with token). Use cases: DB sessions, auth, rate limiting, pagination params, feature flags. Annotated[type, Depends(...)] (Python 3.9+) is the modern syntax.

✏️ Try these changes

Change 'secret123' to 'mypassword'
→ /me?token=mypassword now works
Add a new dependency require_admin that checks user['name'] == 'Ada'
→ admin-only routes
Change get_db's print to a real session: db = SessionLocal()
→ real DB session per request
Add a query param to get_current_user: from fastapi import Cookie; token: Optional[str] = Cookie(None)
→ token now read from cookie instead of query

← Previous lab

Jinja2 templates — render HTML on the server

Next lab →

Forms — Form() instead of JSON body