Curriculum
The Complete 30-Chapter Roadmap
Four parts, six projects, three build milestones. By Chapter 13 you have shipped a production CLI, and from Chapter 20 your work is live on the internet.
- Prerequisites
- Basic Python: functions, loops, and dictionaries. Everything else is taught from scratch.
- Format
- A web-based book you read in the browser. Short pages, runnable code, and a review page per chapter.
- You'll work with
- requests, OAuth 2.0, Flask, FastAPI, SQLite, PostgreSQL, Docker, AWS, and CI/CD.
- Try before you buy
- Chapters 3, 14, and 15 are free to read in full.
Foundations & Core Skills
By the end of Part I you can call any API safely: keys protected, errors handled, responses validated. It ends with the production weather CLI.
Read any REST URL, JSON response, and status code, and know who is at fault when a call fails.
Set up an isolated Python environment and prove it works with a live API call.
Fetch live data with requests, parse the JSON, and guard every call with a timeout.
Validate responses layer by layer and download binary files without corrupting them.
Run full CRUD against any REST API with safe, idempotent write functions.
Write defensive JSON extractors that survive missing keys, nulls, and wrong types.
Keep secrets out of git with the .env pattern and handle 401, 403, and 429 cleanly.
Chain two real APIs behind validation gates so one failure cannot crash the other.
Add retries with exponential backoff and jitter, plus logging that tells you what broke.
Normalise two incompatible vendor formats into one canonical structure.
Query three news APIs, merge and deduplicate the results, and survive partial failures.
Build a three-layer validation pipeline and place it at the right boundary.
Rebuild a fragile script as a four-layer production CLI with a full test suite.
Full-Stack Integration
By the end of Part II you have a full web app with OAuth login, a database, and a test suite, deployed at a live URL.
Log a user in with OAuth 2.0 (state, PKCE, scopes) without touching their password.
Cache API responses in SQLite and answer historical questions with SQL.
Build an OAuth-authenticated Spotify app with a real schema and mocked tests.
Map URLs to functions, render templates, and serve pages from your database with Flask.
Turn the terminal project into a full dashboard with charts and CSRF-protected forms.
Test a real Flask, OAuth, and SQLite app with mocks, fixtures, and CI on every push.
Take the app to a live HTTPS URL and present it with an interview-ready README.
Professional API Techniques
By the end of Part III you can handle file uploads, webhooks, and async fan-out, the techniques real integrations demand.
Handle validated file uploads and stream multi-gigabyte files with flat memory use.
Receive webhooks with verified signatures, idempotency, and a background worker.
Fan out API calls with async so ten requests cost the wall-clock time of one.
Production & Cloud
By the end of Part IV your own FastAPI service runs on AWS in Docker, shipped automatically by CI/CD.
Migrate SQLite to PostgreSQL with connection pooling and version-controlled schema changes.
Move the live Spotify app to PostgreSQL, JSONB included, without losing data.
Ship your own FastAPI service with docs, auth, rate limiting, and a test suite.
Package the API with Docker and orchestrate it with Postgres and Redis locally.
Stand up ECS Fargate, RDS, and a load balancer serving real public traffic on AWS.
Automate deploys with CI/CD, dashboards, alarms, auto-scaling, and rollback.
Scope, build, and deploy a capstone API a hiring manager can run.