REST APIs with Flask

It is built for engineering students and freshers who want to write backends, frontend and mobile developers who need an API for their own app, and Python developers who have written scripts but never a web service. You should know Python functions and dictionaries and have a basic idea of HTTP GET and POST requests. The course does not teach Python basics; Python covers them if you need to start there. No backend experience is assumed.

Code uses Flask 3.x, Flask-SQLAlchemy with SQLAlchemy 2.x style queries (select() with db.session.execute) rather than the older Model.query pattern, Marshmallow for validation, Flask-Migrate for schema changes, Flask-JWT-Extended for login, pytest with the Flask test client, and Gunicorn for serving. The course stays on JSON APIs; Jinja templates and server-rendered pages are outside it.

Every lesson is a few short reading cards built around a short route, an HTTP exchange or a test, with a diagram where one helps and audio narration you can listen to instead of reading. A short multiple-choice quiz follows, with an explanation for every answer. The questions ask what the API would actually do: which status code a request returns, what the JSON body looks like, which line leaks a password hash into a response, or whether an update should be a PUT or a PATCH. That is the reasoning you use when you review or debug an API. The final section compares look-alike choices, such as 401 and 403, sessions and JWT tokens, or hashing and encryption, and then works through scenarios such as designing an API for a mobile client, debugging a 500 error in production and releasing a schema migration safely.

APIs often break in a few predictable ways, and each of these has its own lesson:

• Returning the wrong status code, such as 401 where 403 belongs
• Leaking internal fields, such as password hashes, in serialised responses
• Storing passwords without a salt or a slow hashing work factor
• Circular imports once an app grows beyond a single file
• Leaving the database session broken after a failed commit instead of rolling back
• Letting clients sort by any column instead of an allowlist
• Running the development server or debug mode in production
• Breaking existing clients by renaming a field without a versioning plan

Udemy and Coursera mostly teach Flask through video lectures, where an instructor builds an app on screen from start to finish. freeCodeCamp is known for long project-based tutorials. This course does a different job: short narrated lessons followed by questions that make you choose a status code, a pagination style or a versioning scheme, and predict what a request will return before you send it. Video suits following one complete build, and tutorials suit typing along. This format builds the judgement to design an API that clients can rely on and to spot the bug in a route quickly. Build your own small API next to it to practise the code.

Start a small API of your own, such as a to-do list, a book catalogue or an expense tracker, and add each lesson's idea to it as you go. Call every endpoint with curl or an HTTP client and read the status code and headers, not just the body. Write a pytest test for each endpoint as soon as it works, so later changes do not quietly break it. Answer each quiz question before reading its explanation, because recalling the answer yourself is what makes it stick. When you reach authentication, test the unhappy paths too: a missing token, an expired token and a user who does not own the resource. For more depth on API design across REST and GraphQL, API Engineering: REST & GraphQL is a good next step.