Skip to content

Korvex

A fast Python web framework, with a router and an HTTP server written in Rust. You write plain Python functions; Korvex calls them for the right requests, checks their input, and documents your API. Use it for JSON APIs, HTML sites and WebSockets where speed matters and plain functions are enough.

New to web APIs? Start with the tutorial.

pip install --pre korvex

A first app

from korvex import App, Response

app = App()


@app.get("/hello/{name}")
def hello(name: str, polite: bool = False):
    return Response.json({"message": f"Good day, {name}" if polite else f"Hi {name}"})


if __name__ == "__main__":
    app.run()

Run python main.py, then open http://127.0.0.1:8000/hello/Ada?polite=true.

  • name comes from the path, polite from the query string, turned into a bool: a parameter's name and type say where it comes from and what it must be.
  • A wrong polite (?polite=maybe) gets a 422 error, with no code of yours.
  • Response.json() sends JSON. With a model (msgspec or pydantic) and a return annotation, return the model: see Validation.
  • app.docs() adds a Swagger UI page at /docs.

Korvex 1.0 is in release candidates: what rc1 froze won't break; features added since can still change until 1.0.0. Install with pip install --pre korvex. Every change is in the changelog.

The guide

Read in order the first time; each page stands alone after.

  1. Routes: paths, parameters, groups, hosts, links between routes, static files.
  2. Validation: typed parameters, models, headers, cookies and forms.
  3. Requests and responses: what a handler gets and returns, streams, Server-Sent Events, background tasks.
  4. Templates: HTML pages, filters, escaping, hashed static URLs.
  5. Sessions and CSRF: signed-cookie sessions, flash messages, CSRF protection.
  6. Dependencies: code shared by routes, like signing in.
  7. Errors and hooks: errors, code that runs around every request, startup and shutdown.
  8. Ready-made middleware: CORS, request IDs, rate limiting, compression, security headers.
  9. WebSockets
  10. OpenAPI and security: the API's description, Swagger UI, sign-in schemes.
  11. Testing
  12. The built-in server: running in production, workers and threads.
  13. Deployment: behind nginx or Caddy, in Docker, on AWS Lambda or Vercel.
  14. Performance: the benchmarks, and how to reproduce them.

Terms you don't know are in the glossary.

The reference lists every class, function and option, from the code's own docstrings.

Also: